80286 


High-Performance Microprocessor with 
Memory Management and Protection 


DISTINCTIVE CHARACTERISTICS 


High performance processor (up to six times iAPX 86 
when using the 8 MHz 80286) 

Large address space 

- 16 megabytes physical 

- 1 gigabyte virtual memory per task 

Integrated memory management, four-level memory 
protection and support for virtual memory and operating 
systems 


@ Two iAPX 86 upward compatible operating modes 
- iAPX 86 real address mode 
- Protected virtual address mode 
@ High bandwidth bus interface (8 megabyte/sec) 
@ Range of clock rates 
- 10 MHz for 80286-10 
— 8 MHz 80286-8 
— 6 MHz 80286-6 


GENERAL DESCRIPTION 


The 80286 is an advanced, high performance microproces- 
sor with specially optimized capabilities for multiple user 
and multi-tasking systems. The 80286 has built-in memory 
protection that supports operating system and task isola- 
tion as well as program and data privacy within tasks. An 8 
MHz 80286 provides up to six times greater throughput 
than the standard 5 MHz 8086. The 80286 includes 
memory management capabilities that map up to 230 bytes 
(one gigabyte) of virtual address space per task into 224 
bytes (16 megabytes) of physical memory. 


The 80286 is upward compatible with iAPX 86 and 88 
software. Using iAPX 86 real address mode, the 80286 is 
object code compatible with existing iAPX 86, 88 software. 


In protected virtual address mode, the 80286 is source 
code compatible with iAPX 86, 88 software and may require 
upgrading to use virtual addresses supported by the 
80286's integrated memory management and protection 
mechanism. Both modes operate at full 80286 performance 
and execute a superset of the iAPX 86 and 88 instructions. 


The 80286 provides special operations to support the 
efficient implementation and execution of operating sys- 
tems. For example, one instruction can end execution of 
one task, save its state, switch to a new task, load its state, 
and start execution of the new task. The 80286 also 
supports virtual memory systems by providing a segment- 
not-present exception and restartable instructions. 
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ORDERING INFORMATION 


Commodity Products 


AMD products are available in several packages and operating ranges. The order number (Valid Combination) is formed 


by a combination of: A. Temperature Range 
B. Package Type 
C. Device Number 
D. Speed Option (if applicable) 
E. Optional Processing 


80286 B 


Blank = Standard 
Processing 
B = Burn-in 


D. SPEED OPTION 
-10 = 10 MHz 
-8=8 MHz 
-6=6 MHz 


Cc. DEVICE NUMBER/DESCRIPTION 
80286 
High Performance Microprocessor 


B. PACKAGE TYPE 
R = 68-Pin Ceramic Leadless Chip Carrier 
A= 68-Pin Pin Grid Array 


A. TEMPERATURE RANGE 
Blank = Commercial (0 to + 55°C) 


=10 B 
ie OPTIONAL PROCESSING | R, A, 80286 


Valid Combinations 


Valid Combinations 
Consult the local AMD sales office to confirm 
availability of specific valid combinations, to 
check on newly released valid combinations, 
and to obtain additional data on AMD's standard 
military grade products. 









PIN DESCRIPTION 
Active oe 
I cripti 
nme [mame [vo | tment 
Active CLK System Clock provides the fundamental timing for 80286 systems. It is a 16 MHz signal divided by two 
HIGH inside the 80286 to generate the 8 MHz processor clock. The internal divide-by-two circuitry can be 
synchronized to an external clock generator by a LOW-to-HIGH transition on the RESET input. 
Active Do- Dis 1/0 Data Bus inputs data during memory, I/O, and interrupt acknowledge read cycles; outputs data during 
HIGH memory and I/O write cycles. The data bus is active HIGH and floats to three-state OFF during bus hold 
Active A23 - Ao 
HIGH 


acknowledge. 
Active BHE 
LOW 
[0 [Reeves SC*~*d 


Address Bus outputs physical memory and I/O port addresses. Ag is LOW when data is to be transferred 
Active Si, SO 
LOW 
1 
None; not a status cycle 


on pins D7~9. Azg-A16 are LOW during |/O transfers. The address bus is active HIGH and floats to 
three-state OFF during bus hold acknowledge. 
Bus High Enable indicates transfer of data on the upper byte of the data_bus D15-~. Ejight-bit oriented 

M/1O Memory/IO Select distinguishes memory access from I/O access. If HIGH during Ts, a memory cycle or a 
halt/shutdown cycle is in progress. If LOW, an I/O cycle or an interrupt acknowledge cycle is in progress. 
M/IO floats to three-state OFF during bus hold acknowledge. 

COD/INTA Code/Interrupt Acknowledge distinguishes instruction fetch cycles from memory data read cycles. Also 
distinguishes interrupt acknowledge cycles from 1/O cycles. COD/INTA floats to three-state OFF during bus 
hold acknowledge. 

Active LOCK Bus Lock indicates that_other system bus masters are not to gain control of the system bus following the 
LOW current bus cycle. The LOCK signal may be activated explicitly by the '"LOCK"’ instruction prefix or 
automatically by 80286 hardware during memory XCHG instructions, interrupt acknowledge, or descriptor 
table access. LOCK is active LOW and floats to three-state OFF during bus hold acknowledge. 


devices assigned to the upper byte of the data bus would normally use BHE to condition chip select 
Active READY Bus Ready terminates a bus cycle. Bus cycles are extended without limit until terminated by READY LOW. 
LOW READY is an active LOW synchronous input requiring set-up and hold times relative to the system clock be 
met for correct operation. READY is ignored during bus hold acknowledge. 


functions. BHE is active LOW and floats to three-state OFF during bus hold acknowledge. 
HOLD, a Bus Hold Request and Hold Acknowledge control ownership of the 80286 local bus. The HOLD input allows 
HIGH HLDA 












































Reserved 


Bus Cycle Status indicates initiation of a bus cycle and, along with M/IO_and COD/INTA, defines the type 
of bus cycle. The bus is in a Tg state whenever one or both are LOW. S17 and SO are active LOW and 
float to three-state OFF during bus hold acknowledge. 


[coo/inTA [W/O] Si] 50 | Bus cycle initiated ————C—* 
[owom | 0 | 
None; not a status cycle 


None; not a status cycle 
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BHE and Ao Encodings 
another local bus master to request contro! of the local bus. When control is granted, the 80286 will float 


BHE Value} Ao Value 
[8 |_| Wore Transfer 
a ae ee See Byte transfer on upper half of data bus (D15~ g) 
[Sat <li or = f| Byte transfer on lower half of data bus (D7 _ 9) 

its bus drivers to three-state OFF and then active HLDA, thus entering the bus hold acknowledge condition. 
The local bus will remain granted to the requesting master until HOLD becomes inactive which results in the 
80286 deactivating HLDA and regaining contro! of the local bus. This terminates the bus hold acknowledge 
condition. HOLD may be asynchronous to the system clock. These signals are active HIGH. 



































PIN DESCRIPTION (Cont.) 


Active -_ 
te Toname [vo | tenets 


Active Interrupt Request requests the 80286 to suspend its current program execution and service a pending 

HIGH : external request. Interrupt requests are masked whenever the interrupt enable bit in the flag word is cleared. 
When the 80286 responds to an interrupt request, it performs two interrupt acknowledge bus cycles to read 
an 8-bit interrupt vector that identifies the source of the interrupt. To assure program interruption, INTR must 
remain active until the first interrupt acknowledge cycle is completed. INTR is sampled at the beginning of 
each processor cycle and must be active HIGH at least two processor cycles before the current instruction 
ends in order to interrupt before the next instruction. INTR is level sensitive, active HIGH, and may be 
asynchronous to the system clock. 


Non-maskable Interrupt Request interrupts the 80286 with an internally supplied vector value of 2. No 
interrupt acknowledge cycles are performed. The interrupt enable bit in the 80286 flag word does not affect 
this input. The NMI input is active HIGH, may be asynchronous to the system clock, and is edge triggered 
after internal synchronization. For proper recognition, the input must have been previously LOW for at least 
four system clock cycles and remain HIGH for at least four system clock cycles. 


Processor Extension Operand Request and Acknowledge extended the memory management and protection 
capabilities of the 80286 to processor extensions. The PEREQ input requests the 80286 to perform a data 
operand transfer for a processor extension. The PEACK output signals the processor extension when the 
requested operand is being transferred. PEREQ is active HIGH and may be asynchronous to the system 
clock. PEACK is active LOW. 


Processor Extension Busy and Error indicate the operating condition of a processor extension to the 80286. 
An active BUSY input stops 80286 program execution on WAIT and some ESC instructions until BUSY 
becomes inactive (HIGH). The 80286 may be interrupted while waiting for BUSY to become inactive. An 
active ERROR input causes the 80286 to perform a processor extension interrupt when executing WAIT or 
some ESC instructions. These inputs are active LOW and may be asynchronous to the system clock. 














































Active BUSY, 
LOW ERROR 


Active RESET System Reset clears the internal logic of the 80286 and is active HIGH. The 80286 may be reinitialized at 
HIGH any time with a LOW-to-HIGH transition on RESET which remains active for more than 16 system clock 
cycles. During RESET active, the output pins of the 80286 enter the state shown below: 
80286 Pin State During Reset 
1 (HIGH) SO, S1, PEACK, Ao3- Ao, BHE, LOCK 
RESET are only required for systems where the processor clock must be phase synchronous to another 
clock. 
























0 (LOW) M/TO, COD/INTA, HLDA 
three-state OFF 


Operation of the 80286 begins after a HIGH-to-LOW transition on RESET. The HIGH-to-LOW transition of 
RESET must be synchronous to the system clock. Approximately 50 system clock cycles are required by 
the 80286 for internal initializations before the first bus cycle to fetch code from the power-on execution 
address is performed. 


















A LOW-to-HIGH transition of RESET synchronous to the system clock, will begin a new processor cycle at 
the next HIGH-to-LOW transition of the system clock. The LOW-to-HIGH transition of RESET may be 
asynchronous to the system clock; however, in this case it cannot be predetermined which phase of the 
processor clock will occur during the next system clock period. Synchronous LOW-to-HIGH transitions of 


Active Vss System Ground: 0 VOLTS. 

HIGH : 

Active eee eal System Power: +5 Volt Power Supply. 
HIGH 


wa Substrate Filter Capacitor: a 0.047uf +20% 12 V capacitor must be connected between this pin and ground. 
HIGH 


This capacitor filters the output of the internal substrate bias generator. A maximum DC leakage current of 
1 ya is allowed through the capacitor. 





For correct operation of the 80286, the substrate bias generator must charge this capacitor to its operating 
voltage. The capacitor charge-up time is 5 milliseconds (max.) after Vcc and CLK reach their specified AC 
and DC parameters. RESET may be applied to prevent spurious activity by the CPU during this time. After 
this time, the 80286 processor clock can be phase synchronized to another clock by pulsing RESET LOW 
synchronous to the system clock. 






FUNCTIONAL DESCRIPTION In iAPX 86 real address mode programs use real addresses 
with up to one megabyte of address space. Programs use 
Introduction virtual addresses in protected virtual address mode, also 


called protected mode. In protected mode, the 80286 CPU 
automatically maps 1 gigabyte of virtual addresses per task 
into a 16 megabyte real address space. This mode also 
provides memory protection to isolate the operating system 
and ensure privacy of each task's programs and data. Both 
modes provide the same base instruction set, registers, and 
addressing modes. 


The 80286 is an advanced, high-performance microprocessor 
with specially optimized capabilities for multiple user and multi- 
tasking systems. Depending on the application, the 80286's 
performance is up to six times faster than the standard 5 MHz 
8086's, while providing complete upward software compatibili- 
ty with AMD's iAPX 86, 88, and 186 family of CPU's. 


The following pages describe first, the base 80286 architec- 
ture common to both modes; second, iAPX 86 real address 
mode; and third, protected mode. 


The 80286 operates in two modes: iAPX 86 real address mode 
and protected virtual address mode. Both modes execute a 
superset of the iAPX 86 and 88 instruction set. 


80286 Base Architecture 


The iAPX 86, 88, 186, and 286 CPU family all contain the 
same basic set of registers, instructions, and addressing 
modes. The 80286 processor is upward compatible with the 
8086, 8088, and 80186 CPU's. 


Register Set 


The 80286 base architecture has fifteen registers as shown in 





Segment Registers: Four 16-bit special purpose registers 
select, at any given time, the segments of memory that are 
immediately addressable for code, stack, and data. (For 
usage, refer to Memory Organization.) 


Base and Index Registers: Four of the general purpose 
registers may also be used to determine offset addresses of 
operands in memory. These registers may contain base 
addresses or indexes to particular locations within a segment. 
The addressing mode determines the specific registers used 
for operand address calculations. 


Status and Control Registers: Three 16-bit special purpose 
registers record or control certain aspects of the 80286 
processor state. These include the Instruction Pointer, which 
contains the offset address of the next sequential instruction 
to be executed. 


CODE SEGMENT SELECTOR 
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CONTROL FLAGS: 
TRAP FLAG 
INTERRUPT ENABLE 
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SPECIAL FIELDS: 
VO PRIVILEGE LEVEL 
NESTED TASK FLAG 


a Figure 1. These registers are grouped into the following four 
categories: 
General Registers: Eight 16-bit general purpose registers 
used to contain arithmetic and logical operands. Four of these 
(AX, BX, CX, and DX) can be used either in their entirety as 16- 
bit words or split into pairs of separate 8-bit registers. 
16-BIT SPECIAL 
REGISTER REGISTER 
NAME FUNCTIONS. 
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Figure 2. Status and Control Register Bit Functions 





Flags Word Description 


The Flags word (Flags) records specific characteristics of the 
result of logical and arithmetic instructions (bits 0, 2, 4, 6, 7, 
and 11) and controls the operation of the 80286 within a given 
operating mode (bits 8 and 9). Flags is a 16-bit register. The 
function of the flag bits is given in Table 1. 


Table 1. Flags Word Bit Functions 


Bit 
Position 
CF |Carry Flag — Set on high-order bit carry or 
borrow; cleared otherwise 
PF |Parity Flag— Set if low-order 8 bits of 
result contain an even number of 1 bits; 
cleared otherwise 
4 AF |Set on carry-from or borrow-to the low- 
order four bits of AL; cleared otherwise 
ZF |Zero Flag — Set if result is zero; cleared 
otherwise 
7 SF |Sign Flag — Set equal to high-order bit of 
result (0 if positive, 1 if negative) 
af OF |Overflow Flag — Set if result is a too-large 
large positive number or a too-small 
negative number (excluding sign-bit) to fit 


in destination operand; cleared otherwise 


Single Step Flag— Once set, a single 
step interrupt occurs after the next 
instruction executes. TF is cleared by the 


single step interrupt. 


IF |interrupt-Enable Flag— When set, 
maskable interrupts will cause the CPU to 
transfer control to an interrupt vector 
specified location 


Direction Flag — Causes string 
instructions to auto decrement the 
appropriate index registers when set. 
Clearing DF causes auto increment. 


GENERAL PURPOSE 


MOV Move byte or word 
PUSH Push word onto stack 
Pop word off stack 
PUSHA Push all registers on stack 
POPA Pop all registers from stack 
XCHG Exchange byte or word 
T Translate byte 
INPUT/OUTPUT 


out 
(Ds 
LES 
POPF 


Figure 3. Data Transfer Instructions 


Decimal adjust for subtraction 
MULTIPLICATION 


iMUL 

AAM ASCII adjust for multiply 

IDV 
A 


Figure 4. Arithmetic Instructions 


[rep [Repeat 


Figure 5. String Instructions 


LOGICALS 
NOT "Not" byte or word 
AND "And" byte or word 


"Inclusive or’ byte or word 
XOR "Exclusive or’ byte or word 


TEST 
SHUSAL 
SHA 

FRO [Rotate ioht byte or word = 


Figure 6. Shift/Rotate/Logical Instructions 


ADD 
ADC 
INC 

AAA 
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SUB 
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DEC 
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ie ITERATION CONTROLS 
JL/JINGE Loop if not equal/not zero 
JLE/JNG JCXZ Jump if register CX =0 

me ae 

INE/INZ 

0 
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UNCONDITIONAL TRANSFERS 
Call procedure 

Return from procedure 
Jump 








INTERRUPTS 





J 

JN 

JN Jump if not sign INTO Interrupt if overflow 
JO Jump if overflow IRET Interrupt return 
JP/JPE Jump if parity/parity even 


JS Jump if sign 










Figure 7. Program Transfer Instructions 
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Figure 8. Processor Control Instructions 


ENTER Format stack for procedure entry 
LEAVE Restore stack for procedure exit 


BOUND | Detects values outside prescribed range 














STD 
CLD 
STI 
CLI 























Figure 9. High-Level Instructions 


Memory Organization 


Memory is organized as sets of variable length segments. 
Each segment is a linear contiguous sequence of up to 
64K(2'6) 8-bit bytes. Memory is addressed using a two- 
component address (a pointer) that consists of a 16-bit 
segment selector and a 16-bit offset. The segment selector 
indicates the desired segment in memory. The offset compo- 
nent indicates the desired byte address within the segment. 
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Figure 10. Two-Component Address 






























Instructions 


Code (CS) 


External (Global) Data Extra (ES) 


All instructions that address operands in memory must specify 
the segment and the offset. For speed and compact instruc- 
tion encoding, segment selectors are usually stored in the high 
speed segment registers. An instruction need specify only the 
desired segment register and an offset to address a memory 
operand. 





Most instructions need not explicitly specify which segment 
register is used. The correct segment register is automatically 
chosen according to the rules of Table 2. These rules follow 
the way programs are written (see Figure 11) as independent 
modules that require areas for code and data, a stack, and 
access to external data areas. 


Special segment override instruction prefixes allow the implicit 
segment register selection rules to be overridden for special 
cases. The stack, data, and extra segments may coincide for 
simple programs. To access operands that do not reside in 
one of the four immediately available segments, either a full 
32-bit pointer can be used or a new segment selector must be 
loaded. 


















Addressing Modes 


The 80286 provides a total of eight addressing modes for 
instructions to specify operands. Two addressing modes are 
provided for instructions that operate on register or immediate 
operands: 


Register Operand Mode: The operand is located in one of 
the 8- or 16-bit general registers. 


Immediate Operand Mode: The operand is included in the 
instruction. 


Six modes are provided to specify the location of an operand 
in a memory segment. A memory operand address consists of 
two 16-bit components: segment selector and offset. The 
segment selector is supplied by a segment register either 
implicitly chosen by the addressing mode or explicitly chosen 
by a segment override prefix. The offset is calculated by 
summing any combination of the following three address 
elements: 
















the displacement (an 8- or 16-bit immediate value con- 
tained in the instruction) 


the base (contents of either the BX or BP base registers) 
the index (contents of either the SI or DI index registers) 


Any carry out from the 16-bit addition is ignored. Eight-bit 
displacements are sign extended to 16-bit values. 


Combinations of these three address elements define the six 
memory addressing modes, here described. 


Direct Mode: The operand's offset is contained in the 
instruction as an 8- or 16-bit displacement element. 





Table 2. Segment Register Selection Rules 
Memory Segment Register Implicit Segment 
Reference Needed Used Selection Rule 


Automatic with instruction prefetch 


Stack (SS) irda pushes and pops. Any memory reference which uses BP as a base 


Local Data Data (DS) All data references except when relative to stack or string destination 


Alternate data segment and destination of string operation 


















Register Indirect Mode: The operand's offset is in one of the 
registers SI, DI, BX, or BP. 


Based Mode: The operand's offset is the sum of an 8- or 16- 
bit displacement and the contents of a base register (BX or 
BP). 


MODULE A 


MODULE B 


PROCESS 
STACK 


PROCESS 
DATA 
BLOCK 1 







PROCESS 
DATA 
BLOCK 2 








| | 

t_-_—Jd 
MEMORY 
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Figure 11. Segmented Memory Helps 
Structure Software 


Indexed Mode: The operand's offset is the sum of an 8- or 
16-bit displacement and the contents of an index register (SI 
or Dl). 


Based Indexed Mode: The operand's offset is the sum of the 
contents of a base register and an index register. 


Based Indexed Mode with Displacement: The operand's 
offset is the sum of a base register's contents, an index 
register's contents, and an 8- or 16-bit displacement. 


Data Types 


The 80286 directly supports the following data types: 


Integer: A signed binary numeric value contained 
in an 8-bit byte or a 16-bit word. All op- 
erations assume a 2's complement repre- 
sentation. Signed 32- and 64-bit integers 
are supported using the 80287 Numeric 
Data Processor. 


Ordinal: An unsigned binary numeric value con- 
tained in an 8-bit byte or 16-bit word. 


Pointer: A 32-bit quantity, composed of a segment 
selector component and an offset compo- 
nent. Each component is a 16-bit word. 


String: A contiguous sequence of bytes or words. 


A string may contain from 1 byte to 64K 
bytes. 


A byte representation of alphanumeric 
and control characters using the ASCII 
standard of character representation. 


BCD: A byte (unpacked) representation of the 
decimal digits 0-9. 


Packed BCD: A byte (packed) representation of two 
decimal digits 0-9 storing one digit in 
each nibble of the byte. 


Floating Point: A signed 32-, 64-, or 80-bit real number 
representation. (Floating point operands 
are supported using the iAPX 287 Numer- 
ic Processor configuration.) 


Figure 12 graphically represents the data types supported by 
the 80286. 


1/O Space 


The I/O space consists of 64K 8-bit or 32K 16-bit ports. I/O 
instructions address the I/O space with either an 8-bit port 
address, specified in the instruction, or a 16-bit port address in 
the DX register. 8-bit port addresses are zero extended such 
that A15-Ag are LOW. I/O port addresses 00F8(H) through 
OOFF(H) are reserved. 
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Figure 12. 80286 Supported Data Types 





Table 3. Interrupt Vector Assignments 


Return Address 


Related Before Instruction 


Instructions 


Interrupt 
Number 


Divide error exception 

Single step interrupt 

NMI interrupt 

Breakpoint interrupt 

INTO detected overflow exception 
BOUND range exceeded exception 
Invalid opcode exception 
Processor extension not available exception 
Reserved 

Processor extension error input 
Reserved 


User defined 


Interrupts 


An interrupt transfers execution to a new program location. 
The old program address (CS:IP) and machine state (Flags) 
are saved on the stack to allow resumption of the interrupted 
program. Interrupts fall into three classes: hardware initiated, 
INT instructions, and instruction exceptions. Hardware initiated 
interrupts occur in response to an external input and are 
classified as non-maskable or maskable. Programs may cause 
an interrupt with an INT instruction. Instruction exceptions 
occur when an unusual condition, which prevents further 
instruction processing, is detected while attempting to execute 
an instruction. The return address from an exception will 
always point at the instruction causing the exception and 
include any leading instruction prefixes. 


A table containing up to 256 pointers defines the proper 
interrupt service routine for each interrupt. Interrupts 0-31, 
some of which are used for instruction exceptions, are 
reserved. For each interrupt, an 8-bit vector must be supplied 
to the 80286 which identifies the appropriate table entry. 
Exceptions supply the interrupt vector internally. INT instruc- 
tions contain or imply the vector and allow access to all 256 
interrupts. Maskable hardware initiated interrupts supply the 8- 
bit vector to the CPU during an interrupt acknowledge bus 
sequence. Non-maskable hardware interrupts use a prede- 
fined internally supplied vector. 


Maskable Interrupt (INTR) 


The 80286 provides a maskable hardware interrupt request 
pin, INTR. Software enables this input by setting the interrupt 
flag bit (IF) in the flag word. All 224 user-defined interrupt 
sources can share this input, yet they can retain separate 
interrupt handlers. An 8-bit vector read by the CPU during the 
interrupt acknowledge sequence (discussed in System Inter- 
face section) identifies the source of the interrupt. 


Further maskable interrupts are disabled while servicing an 
interrupt by resetting the IF but as part of the response to an 
interrupt or exception. The saved flag word will reflect the 
enable status of the processor prior to the interrupt. Until the 


Causing Exception? 





Any undefined opcode 
ESC or WAIT 
ESC or WAIT 


Yes 
Yes 


flag word is restored to the flag register, the interrupt flag will 
be zero unless specifically set. The interrupt return instruction 
includes restoring the flag word, thereby restoring the original 
status of IF. 


Non-Maskable Interrupt Request (NMI) 


A non-maskable interrupt input (NMI) is also provided. NMI 
has higher priority than INTR. A typical use of NMI would be to 
activate a power failure routine. The activation of this input 
causes an interrupt with an internally supplied vector value of 
2. No external interrupt acknowledge sequence is performed. 


While executing the NMI servicing procedure, the 80286 will 
not service further NMI requests, INTR requests, or the 
processor extension segment overrun interrupt until an inter- 
rupt return (IRET) instruction is executed or the CPU is reset. If 
NMI occurs while currently servicing an NMI, its presence will 
be saved for servicing after executing the first IRET instruc- 
tion. IF is cleared at the beginning of an NMI interrupt to inhibit 
INTR interrupts. 


Single Step Interrupt 


The 80286 has an internal interrupt that allows programs to 
execute one instruction at a time. It is called the single step 
interrupt and is controlled by the single step flag bit (TF) in the 
flag word. Once this bit is set, an internal single step interrupt 
will occur after the next instruction has been executed. The 
interrupt clears the TF bit and uses an internally supplied 
vector of 1. The IRET instruction is used to set the TF bit and 
transfer control to the next instruction to be single stepped. 


Interrupt Priorities 


When simultaneous interrupt requests occur, they are pro- 
cessed in a fixed order as shown in Table 4. Interrupt 
processing involves saving the flags, return address, and 
setting CS:IP to point at the first instruction of the interrupt 
handler. If other interrupts remain enabled, they are processed 
before the first instruction of the current interrupt handler is 
executed. The last interrupt processed is therefore the first 
one serviced. 





Table 4. Interrupt Processing Order 


INT instruction or exception 
Single step 


Initialization and Processor Reset 


Processor initialization or start up is accomplished by driving 
the RESET input pin HIGH. RESET forces the 80286 to 
terminate all execution and local bus activity. No instruction or 
bus activity will occur as long as RESET is active. After RESET 
becomes inactive and an internal processing interval elapses, 
the 80286 begins execution in real address mode with the 
instruction at physical location FFFFFO(H). RESET also sets 
some registers to predefined values as shown in Table 5. 


Table 5. 80286 Initial Register State after RESET 


Flag word 

Machine Status Word 
Instruction pointer 
Code segment 

Data segment 

Extra segment 

Stack segment 


Machine Status Word Description 


The machine status word (MSW) records when a task switch 
takes place and controls the operating mode of the 80286. It is 
a 16-bit register of which the lower four bits are used. One bit 
places the CPU into protected mode, while the other three 
bits, as shown in Table 6, control the processor extension 
interface. After RESET, this register contains FFFO(H) which 
places the 80286 in iAPX 86 real address mode. 


Table 6. MSW Bit Functions 
Bit 
Position 
Protected mode Enable places the 
PE | 80286 into protected mode and cannot 

be cleared except by RESET. 
Monitor Processor extension allows 

1 WAIT instructions to cause a processor 
extension not present exception 
(number 7). 
Emulate processor extension causes a 
Processor extension not present 

2 exception (number 7) on ESC 
instructions to allow emulating a 
processor extension. 


Task Switched indicates the next 
instruction using a processor extension 

3 TS will cause exception 7, allowing 
software to test whether the current 
processor extension context belongs to 
the current task. 


The LMSW and SMSW instructions can load and store the 
MSW in real address mode. The recommended use of TS, EM, 
and MP is shown in Table 7. 


Halt 


The HLT instruction stops program execution and prevents 
the CPU from using the local bus until restarted. Either NMI, 
INTR with IF = 1, or RESET will force the 80286 out of halt. If 
interrupted, the saved CS:IP will point to the next instruction 
after the HLT. 


iAPX 86 Real Address Mode 


The 80286 executes a fully upward-compatible superset of the 
8086 instruction set in real address mode. In real address 
mode the 80286 is object code compatible with 8086 and 
8088 software. The real address mode architecture (registers 
and addressing modes) is exactly as described in the 80286 
Base Architecture section. 


Table 7. Recommended MSW Encodings For Processor Extension Control 


Recommended Use 


Instructions 
Causing 
Exception 


iAPX 86 real address mode only. Initial encoding after RESET. 80286 operation is 


identical to iAPX 86, 88. 


A processor extension exists. 


i ion. ESC 
No processor extension is available. Software will emulate its function. The current ESC 
processor extension context may belong to another task. 


None 


A processor extension exists. The current processor extension context may belong 


to another task. The exception on WAIT allows software to test for an error pending 


ESC or WAIT 


from a previous processor extension operation. 































Memory Size 


Physical memory is a contiguous array of up to 1,048,576 
bytes (one megabyte) addressed by pins Ao through Aig and 
BHE. Ago through Agg are ignored. 


Memory Addressing 


In real address mode the processor generates 20-bit physical 
addresses directly from a 20-bit segment base address and a 
16-bit offset. 


The selector portion of a pointer is interpreted as the upper 16 
bits of a 20-bit segment address. The lower four bits of the 20- 
bit segment address are always zero. Segment addresses, 
therefore, begin on multiples of 16 bytes. See Figure 13 for a 
graphic representation of address formation. 
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Figure 13. iAPX 86 Real Address Mode 
Address Calculation 


All segments in real address mode are 64K bytes in size and 
may be read, written, or executed. An exception or interrupt 
can occur if data operands or instructions attempt to wrap 
around the end of a segment (e.g. a word with its low order 
byte at offset FFFF(H) and its high order byte at offset 
0000(H)). If, in real address mode, the information contained in 
a segment does not use the full 64K bytes, the unused end of 
the segment may be overlayed by another segment to reduce 
physical memory requirements. 


Reserved Memory Locations 


The 80286 reserves two fixed areas of memory in real address 
mode (see Figure 14): system initialization area and interrupt 
table area. Locations from addresses FFFFO(H) through 
FFFFF(H) are reserved for system initialization. Initial execu- 
tion begins at location FFFFO(H). Locations 00000(H) through 
OO3FF(H) are reserved for interrupt vectors. 


FFFFFH 
RESET BOOTSTRAP 


PROGRAM JUMP FFFFOH 


INTERRUPT POINTER 
FOR VECTOR 255 


. 


INTERRUPT POINTER 
FOR VECTOR 1 


INTERRUPT POINTER 
FOR VECTOR 0 
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Figure 14. iAPX 86 Real Address Mode Ini- 
tially Reserved Memory Locations 


Table 8. Real Address Mode Addressing Interrupts 


Return Address 











Interrupt Related 
Number Instructions 
Interrupt table limit too small exception =e INT vector is not within table limit 


Processor extension segment overrun interrupt ee ESC with memory operand extending 


beyond offset FFFF(H) 
13 


Before Instruction? 

























Word memory reference with 
offset = FFFF(H) or an attempt to execute 
past the end of a segment 





Segment overrun exception 


14 





Interrupts 


Table 8 shows the interrupt vectors reserved for exceptions 
and interrupts which indicate an addressing error. The excep- 
tions leave the CPU in the state existing before attempting to 
execute the failing instruction (except for PUSH, POP, PUSHA, 
or POPA). Refer to the next section on protected mode 
initialization for a discussion on exception 8. 


Protected Mode Initialization 


To prepare the 80286 for protected mode, the LIDT instruction 
is used to load the 24-bit interrupt table base and 16-bit limit 
for the protected mode interrupt table. This instruction can 
also set a base and limit for the interrupt vector table in real 
address mode. After reset, the interrupt table base is initialized 
to 000000(H) and its size set to O3FF(H). These values are 
compatible with iAPX 86, 88 software. LIDT should only be 
executed in preparation for the protected mode. 


Shutdown 


Shutdown occurs when a severe error is detected that 

prevents further instruction processing by the CPU. Shutdown 

and halt are externally signalled via a halt bus operation. They 

can be distinguished by Ay HIGH for halt and Ay LOW for 

shutdown. In real address mode, shutdown can occur under 

two conditions: 

© Exceptions 8 or 13 happen and the IDT limit does not 
include the interrupt vector. 

© ACALL, INT, or POP instruction attempts to wrap around 
the stack segment when SP is not even. 


An NMI input can bring the CPU out of shutdown if the IDT 
limit is at least OOOF(H) and SP is greater than 0005(H); 
otherwise, shutdown can only be exited via the RESET input. 


Protected Virtual Address Mode 


The 80286 executes a fully upward-compatible superset of the 
8086 instruction set in protected virtual address mode (pro- 
tected mode). Protected mode also provides memory man- 
agement and protection mechanisms and associated instruc- 
tions. 


The 80286 enters protected virtual address mode from real 
address mode by setting the PE (Protection Enable) bit of the 
machine status word with the Load Machine Status Word 
(LMSW) instruction. Protected mode offers extended physical 
and virtual memory address space, memory protection mecha- 
nisms, and new operations to support operating systems and 
virtual memory. 


All registers, instructions, and addressing modes described in 
the 80286 Base Architecture section remain the same. Pro- 
grams for the iAPX 86, 88, 186, and real address mode 80286 
can be run in protected mode; however, embedded constants 
for segment selectors are different. 


Memory Size 


The protected mode 80286 provides a 1 gigabyte virtual 
address space per task mapped into a 16-megabyte physical 
address space defined by the address pin Az3 - Ap and BHE. 
The virtual address space may be larger than the physical 
address space since any use of an address that does not map 
to a physical memory location will cause a restartable excep- 
tion. 


Memory Addressing 


As in real address mode, protected mode uses 32-bit pointers, 
consisting of 16-bit selector and offset components. The 
selector, however, specifies an index into a memory resident 





table rather than the upper 16-bits of a real memory address. 
The 24-bit base address of the desired segment is obtained 
from the tables in memory. The 16-bit offset is added to the 
segment base address to form the physical address as shown 
in Figure 15. The tables are automatically referenced by the 
CPU whenever a segment register is loaded with a selector. 
All 80286 instructions which load a segment register will 
reference the memory based tables without additional soft- 
ware. The memory based tables contain 8 byte values called 
descriptors. 
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Figure 15. Protected Mode Memory 
Addressing 


Descriptors 


Descriptors define the use of memory. Special types of 
descriptors also define new functions for transfer of control 
and task switching. The 80286 has segment descriptors for 
code, stack and data segments, and system control descrip- 
tors for special system data segments and control transfer 
operations. Descriptor accesses are performed as locked bus 
operations to assure descriptor integrity in multi-processor 
systems. 


Code and Data Segment Descriptors 


Besides segment base addresses, code and data descriptors 
contain other segment attributes including segment size (1 to 
64K bytes), access rights (read only, read/write, execute only, 
and execute/read), and presence in memory (for virtual 
memory systems)(see Figure 16). Any segment usage violat- 
ing a segment attribute indicated by the segment descriptor 
will prevent the memory cycle and cause an exception or 
interrupt. 


RESERVED 
ACCESS 
RIGHTS BYTE DPL TYPE BASE23-16 


BASE\5-0 





15 87 0 
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*Must be set to 0 for compatability with iAPX 386. 











Access Rights Byte Definition 


Bit 
Position 


Present (P) 


Segment is mapped into physical memory. 


No mapping to physical memory exists; base and limit are not used. 


Descriptor Privilege 
Level (DPL) 


Segment Descriptor (S) 


Executable (E) 
Expansion Direction 
(ED) 


Writable (W) 
Field 
Definition Executable (E) 


Conforming (C) 


Readable (R) 
R=1 


Eo! — 
A= 





ED = 1 Grow down segment, offsets must be > limit. 


Segment privilege attribute used in privilege tests. 
Code or Data segment descriptor 
Non-segment descriptor 


Data segment descriptor type is: 
0 Grow up segment, offsets must be < limit. 


Data 
Segment 


W=0 Data segment may not be written into. 
W=1 Data segment may be written into. 





Code Segment Descriptor type is: 


Code segment may only be executed when 
CPL = DPL. 


R=0 Code segment may not be read. 
Code segment may be read. 


Code 
Segment 


A=0 Segment has not been accessed. 


Segment selector has been loaded into segment register or used by selector 
test instructions. 


Figure 16. Code and Data Segment Descriptors 


Code and data are stored in two types of segments: code 
segments and data segments. Both types are identified and 
defined by segment descriptors. Code segments are identified 
by the executable (E) bit set to 1 in the descriptor access 
rights byte. The access rights byte of both code and data 
segment descriptor types have three fields in common: 
present (P) bit, Descriptor Privilege Level (DPL), and accessed 
(A) bit. If P = 0, any attempted use of this segment will cause a 
not-present exception. DPL specifies the privilege level of the 
segment descriptor. DPL controls when the descriptor may be 
used by a task (refer to privilege discussion). The A bit shows 
whether the segment has been previously accessed for usage 
profiling, a necessity for virtual memory systems. The CPU will 
always set this bit when accessing the descriptor. 


Data segments (S = 1, E = 0) may be either read-only or read- 
write as controlled by the W bit of the access rights byte. 
Read-only (W =0) data segments may not be written into. 
Data segments may grow in two directions, as determined by 
the Expansion Direction (ED) bit: upwards (ED = 0) for data 
segments, and downwards (ED = 1) for a segment containing 
a stack. The limit field for a data segment descriptor is 
interpreted differently depending on the ED bit (see Figure 16). 


A code segment (S=1, E=1) may be execute-only or 
execute/read as determined by the Readable (R) bit. Code 
segments may never be written into and execute-only code 
segments (R = 0) may not be read. A code segment may also 
have an attribute called Conforming (C). A conforming code 
segment may be shared by programs that execute at different 
privilege levels. The DPL of a conforming code segment 
defines the range of privilege levels at which the segment may 
be executed (refer to privilege discussion). 


System Control Descriptors 


In addition to code and data segment descriptors, the protect- 
ed mode 80286 defines system control descriptors. These 
descriptors define special system data segments and control 
transfer mechanisms in the protected environment. The spe- 
cial system data segment descriptors define segments which 
contain tables of descriptors (Local Descriptor Table Descrip- 
tor) and segments which contain the execution state of a task 
(Task State Segment Descriptor). 
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The control transfer descriptors are call gates, task gates, 
interrupt gates and trap gates. Gates provide a level of 
indirection between the source and destination of the control 
transfer. This indirection allows the CPU to automatically 
perform protection checks and control the entry point of the 
destination. Call gates are used to change privilege levels (see 
Privilege); task gates are used to perform a task switch; and 
interrupt and trap gates are used to specify interrupt service 
routines. The interrupt gate disables interrupts (resets IF) while 
the trap gate does not. 


RESERVED’ 


[P| ort |o) TYPE BASEzs-16 


BASE\5-0 


LIMIT15-0 


o 
TBOO0088 


*Must be set to 0 for compatability with iAPX 386. 


System Segment Descriptor Fields 


[Name | vawe | Description + 
TYPE 1 Available Task State Segment 
2 Local Descriptor Table Descriptor 
3 Busy Task State Segment 
0 Descriptor contents are not valid 
1 Descriptor contents are valid 
Descriptor Privilege Level 
BASE 24-bit |Base Address of special system data 
number |segment in real memory 
LIMIT 16-bit |Offset of last byte in segment 
number 


Figure 17. System Segment Format 





Figure 17 gives the formats for the special system data 
segment descriptors. The descriptors contain a 24-bit base 
address of the segment and a 16-bit limit. The access byte 
defines the type of descriptor, its state and privilege level. The 
descriptor contents are valid and the segment is in physical 
memory if P = 1. If P=0, the segment is not valid. The DPL 
field is only used in Task State Segment descriptors and 
indicates the privilege level at which the descriptor may be 
used (see Privilege). Since the Local Descriptor Table descrip- 
tor may only be used by a special privileged instruction, the 
DPL field is not used. Bit 4 of the access byte is 0 to indicate 
that it is a system control descriptor. The Type field specifies 
the descriptor type as indicated in Figure 17. 


Figure 18 shows the format of the gate descriptors. The 
descriptor contains a destination pointer that points to the 
descriptor of the target segment and the entry point offset. 
The destination selector in an interrupt gate, trap gate, and call 
gate must refer to a code segment descriptor. These gate 
descriptors contain the entry point to prevent a program from 
constructing and using an illegal entry point. Task gates may 
only refer to a task state segment. Since task gates invoke a 
task switch, the destination offset is not used in the task gate. 


Exception 13 is generated when the gate is used if a 
destination selector does not refer to the correct descriptor 
type. The Word Count field is used in the call gate descriptor 
to indicate the number of parameters (0-31 words) to be 
automatically copied from the caller's stack to the stack of the 
called routine when a control transfer changes privilege levels. 
The Word Count field is not used by any other gate descriptor. 


7 07 oO 






fiir be 
+3 DESTINATION SELECTOR 52 +2 
+1 DESTINATION OFFSET 15-9 tt) 
15 87 oO 
TBO00086 


*Must be set to 0 for compatability with iAPX 386. 


Gate Descriptor Fields 









-Call Gate 
-Task Gate 

-Interrupt Gate 
-Trap Gate 


-Descriptor Contents are not 
valid 
—Descriptor Contents are valid 











Number of words to copy from 
callers stack to called 
procedures stack. Only used 
with call gate. 
















Selector to the target code 
segment (Call, Interrupt or 
Trap Gate) 

Selector to the target task 
state segment (Task Gate) 


DESTINATION 16-bit |Entry point within the target 
OFFSET offset |code segment 


Figure 18. Gate Descriptor Format 
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The access byte format is the same for all gate descriptors. 
P =1 indicates that the gate contents are valid. P = 0 indi- 
cates the contents are not valid and causes exception 11 if 
referenced. DPL is the Descriptor Privilege Level and specifies 
when this descriptor may be used by a task (refer to privilege 
discussion). Bit 4 must equal 0 to indicate a system control 
descriptor. The Type field specifies the descriptor type as 
indicated in Figure 18. 


Segment Descriptor Cache Registers 


A segment descriptor cache register is assigned to each of the 
four segment registers (CS, SS, DS, ES). Segment descriptors 
are automatically loaded (cached) into a segment descriptor 
cache register (Figure 20) whenever the associated segment 
register is loaded with a selector. Only segment descriptors 
may be loaded into segment descriptor cache registers. Once 
loaded, all references to that segment of memory use the 
cached descriptor information instead of reaccessing memory. 
The descriptor cache registers are not visible to programs. No 
instructions exist to store their contents. They only change 
when a segment register is loaded. 


Selector Fields 


A protected mode selector has three fields: descriptor entry 
index, local or global descriptor table indicator (TI), and 
selector privilege (RPL) as shown in Figure 19. These fields 
select one of two memory based tables of descriptors, select 
the appropriate table entry and allow high-speed testing of the 
selector's privilege attribute (refer to privilege discussion). 


SELECTOR 
15 Boe 2. 4.0 


INDICATES SELECTOR PRIVILEGE 
LEVEL DESIRED 


=0 USE GLOBAL DESCRIPTOR TABLE 
(GDT) 
Tl=1 USE LOCAL DESCRIPTOR TABLE 
(LDT) 








Figure 19. Selector Fields 
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Local and Global Descriptor Tables 


Two tables of descriptors, called descriptor tables, contain all 
descriptors accessible by a task at any given time. A descrip- 
tor table is a linear array of up to 8192 descriptors. The upper 
13 bits of the selector value are an index into a descriptor 
table. Each table has a 24-bit base register to locate the 
descriptor table in physical memory and a 16-bit limit register 
that confines descriptor access to the defined limits of the 
table as shown in Figure 21. A restartable exception (13) will 
occur if an attempt is made to reference a descriptor outside 
the table limits. 


One table, called the Global Descriptor Table (GDT), contains 
descriptors available to all tasks. The other table, called the 
Local Descriptor Table (LDT), contains descriptors that can be 
private to a task. Each task may have its own private LDT. The 
GDT may contain all descriptor types except interrupt and trap 
descriptors. The LDT may contain only segment, task gate, 
and call gate descriptors. A segment cannot be accessed by a 
task if its segment descriptor does not exist in either descriptor 
table at the time of access. 
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Figure 21. Local and Global Descriptor 
Table Definition 


The LGDT and LLDT instructions load the base and limit of the 
global and local descriptor tables. LGDT and LLDT are 
protected. They may only be executed by trusted programs 
operating at level 0. The LGDT instruction loads a six byte field 
containing the 16-bit table limit and 24-bit base address of the 
Global Descriptor Table as shown in Figure 22. The LLDT 


SEGMENT BASE ADDRESS 


SEGMENT DESCRIPTOR CACHE REGISTERS 


Figure 20. Descriptor Cache Registers 
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instruction loads a selector which refers to a descriptor in the 
Local Descriptor Table. This descriptor contains the base 
address and limit for an LDT, as shown in Figure 17. 
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BASE1s5-0 
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Figure 22. Global Descriptor Table and Inter- 
rupt Descriptor Data Type 


*Must be set to 0 for compatibility with iAPX 386. 


Interrupt Descriptor Table 


The protected mode 80286 has a third descriptor table, called 
the Interrupt Descriptor Table (IDT) (see Figure 23), used to 
define up to 256 interrupts. It may contain only task gates, 
interrupt gates and trap gates. The IDT (Interrupt Descriptor 
Table) has a 24-bit base and 16-bit limit register in the CPU. 
The protected LIDT instruction loads these registers with a 
six-byte value of identical form to that of the LGDT instruction 
(see Figure 22 and Protected Mode Initialization). 
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Figure 23. Interrupt Descriptor Table 
Definition 


References to IDT entries are made via INT instructions, 
external interrupt vectors, or exceptions. The IDT must be at 
least 256 bytes in size to allocate space for all reserved 
interrupts. 






Privilege 


The 80286 has a four-level hierarchical privilege system which 
controls the use of privileged instructions and access to 
descriptors (and their associated segments) within a task. 
Four-level privilege, as shown in Figure 24, is an extension of 
the user/supervisor mode commonly found in minicomputers. 
The privilege levels are numbered 0 through 3. Level 0 is the 
most privileged level. Privilege levels provide protection within 
a task. (Tasks are isolated by providing private LDT's for each 
task.) Operating system routines, interrupt handlers, and other 
system software can be included and protected within the 
virtual address space of each task using the four levels of 
privilege. Tasks may also have a separate stack for each 
privilege level. 


Tasks, descriptors, and selectors have a privilege level 
attribute that determines whether the descriptor may be used. 
Task privilege effects the use of instructions and descriptors. 
Descriptor and selector privilege only effect access to the 
descriptor. 
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Figure 24. Hierarchical Privilege Levels 


Task Privilege 


The task always executes at one of the four privilege levels. A 
task privilege level at any specific instant is called the Current 
Privilege Level (CPL) and is defined by the lower two bits of 
the CS register. CPL cannot change during execution in a 
single code segment. A task's CPL may only be changed by 
control transfers through gate descriptors to a new code 
segment (See Control Transfer). Tasks begin executing at the 
CPL value specified by the code segment when the task is 
initiated via a task switch operation. A task executing at Level 
0 can access all data segments defined in the GDT and the 
task's LDT and is considered the most trusted level. A task 
executed at Level 3 has the most restricted access to data 
and is considered the least trusted level. 


Descriptor Privilege 


Descriptor privilege is specified by the Descriptor Privilege 
Level (DPL) field of the descriptor access byte. DPL specifies 
the least trusted privilege level (CPL) at which a task may 
access the descriptor. Descriptors with DPL = 0 are the most 
protected. Only tasks executing at privilege level 0 (CPL = 0) 
may access them. Descriptors with DPL=3 are the least 
protected (i.e. have the least restricted access) since tasks 
can access them when CPL = 0, 1, 2, or 3. This rule applies to 
all descriptors, except LDT descriptors. 
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Selector Privilege 


Selector privilege is specified by the Requested Privilege 
Level (RPL) field in the least significant two bits of a selector. 
Selector RPL may establish a less trusted privilege level than 
the current privilege level for the use of a selector. This level is 
called the task's effective privilege level (EPL). RPL can only 
reduce the scope of a task's access to data with this selector. 
A task's effective privilege is the numeric maximum of RPL 
and CPL. A selector with RPL=0O imposes no additional 
restriction on its use while a selector with RPL = 3 can only 
refer to segments at privilege Level 3 regardless of the task's 
CPL. RPL is generally used to verify that pointer parameters 
passed to a more trusted procedure are not allowed to use 
data at a more privileged level than the caller (refer to pointer 
testing instructions). 


Descriptor Access and Privilege Validation 


Determining the ability of a task to access a segment involves 
the type of segment to be accessed, the instruction used, the 
type of descriptor used and CPL, RPL, and DPL. The two basic 
types of segment accesses are control transfer (selectors 
loaded into CS) and data (selectors loaded into DS, ES or SS). 


Data Segment Access 


Instructions that load selectors into DS and ES must refer to a 
data segment descriptor or readable code segment descriptor. 
The CPL of the task and the RPL of the selector must be the 
same as or more privileged (numerically equal to or lower 
than) than the descriptor DPL. In general, a task can only 
access data segments at the same or less privileged levels 
than the CPL or RPL (whichever is numerically higher) to 
prevent a program from accessing data it cannot be trusted to 
use. 


An exception to the rule is a readable conforming code 
segment. This type of code segment can be read from any 
privilege level. 


If the privilege checks fail (e.g. DPL is numerically less than 
the maximum of CPL and RPL) or an incorrect type of 
descriptor is referenced (e.g. gate descriptor or execute only 
code segment), exception 13 occurs. If the segment is not 
present, exception 11 is generated. 


Instructions that load selectors into SS must refer to data 
segment descriptors for writable data segments. The descrip- 
tor privilege (DPL) and RPL must equal CPL. All other 
descriptor types or privilege level violation will cause exception 
13. A not present fault causes exception 12. 


Control Transfer 


Four types of control transfer can occur when a selector is 
loaded into CS by a control transfer operation (see Table 10). 
Each transfer type can only occur if the operation which 
loaded the selector references the correct descriptor type. 
Any violation of these descriptor usage rules (e.g. JMP 
through a call gate or RET to a Task State Segment) will 
cause exception 13. 


The ability to reference a descriptor for control transfer is also 
subject to rules of privilege. A CALL or JUMP instruction may 
only reference a code segment descriptor with DPL equal to 
the task CPL or a conforming segment with DPL of equal or 
greater privilege than CPL. The RPL of the selector used to 
reference the code descriptor must have as much privilege as 
CPL. 


RET and IRET instructions may only reference code segment 
descriptors with descriptor privilege equal to or less privileged 
than the task CPL. The selector loaded into CS is the return 
address from the stack. After the return, the selector RPL is 











the task's new CPL. If CPL changes, the old stack pointer is 
popped after the return address. 


When a JMP or CALL references a Task State Segment 
descriptor, the descriptor DPL must be the same or less 
privileged than the task's CPL. Reference to a valid Task State 
Segment descriptor causes a task switch (see Task Switch 
Operation). Reference to a Task State Segment descriptor at 
a more privileged level than the task's CPL generates excep- 
tion 13. 


When an instruction or interrupt references a gate descriptor, 
the gate DPL must have the same or less privilege than the 
task CPL. If DPL is at a more privileged level than CPL, 
exception 13 occurs. If the destination selector contained in 
the gate references a code segment descriptor, the code 
segment descriptor DPL must be the same or more privileged 
than the task CPL. If not, Exception 13 is issued. After the 
control transfer, the code segment descriptor DPL is the task's 
new CPL. If the destination selector in the gate references a 








task state segment, a task switch is automatically performed 
(see Task Switch Operation). 


The privilege rules on control transfer require: 


- JMP or CALL direct to a code segment (code segment 
descriptor) can only be to a conforming segment with DPL of 
equal or greater privilege than CPL or a non-conforming 
segment at the same privilege level. 


- interrupts within the task or calls that may change privilege 
levels can only transfer control through a gate at the same ora 
less privileged level than CPL to a code segment at the same 
or more privileged level than CPL. 


- return instructions that don't switch tasks can only return 
control to a code segment at the same or less privileged level. 


— task switch can be performed by a call, a jump or an interrupt 
which references either a task gate or task state segment at 
the same or less privileged level. 





Table 9. Descriptor Types Used for Control Transfer 





Descriptor 


Descriptor 
Control Transfer Types Operation Types Table 


Intersegment within the same privilege level 






Intersegment to the same or higher privilege level Interrupt 
within task may change CPL. 





Intersegment to a lower privilege level (changes task CPL) 


JMP, CALL, RET, Code Segment GDT/LDT 
IRET* 


CALL Call Gate GDT/LDT 


Interrupt Instruction, 
Exception, External 
Interrupt Gate 


RET, IRET* Code Segment GDT/LDT 


Trap or 
Interrupt 


4 
























CALL, JMP Task State GDT 
Segment 
Task Switch CALL, JMP Task Gate GDT/LDT 
IRET 
Interrupt Instruction, 
Exception, External Task Gate IDT 
Interrupt 





._NT (Nested Task bit of flag word) = 0 
NT (Nested Task bit of flag word) = 1 





Privilege Level Changes 


Any contro! transfer that changes CPL within the task causes 
a change of stacks as part of the operation. Initial values of 
SS:SP for privilege levels 0, 1, and 2 are kept in the task state 
segment (refer to Task Switch Operation). During a JMP or 
CALL control transfer, the new stack pointer is loaded into the 
SS and SP registers and the previous stack pointer is pushed 
onto the new stack. 


When returning to the original privilege level, its stack is 
restored as part of the RET or IRET instruction operation. For 
subroutine calls that pass parameters on the stack and cross 
privilege levels, a fixed number of words, as specified in the 
gate, are copied from the previous stack to the current stack. 
The intersegment RET instruction with a stack adjustment 
value will correctly restore the previous stack pointer upon 
return. 


Protection 











The 80286 includes mechanisms to protect critical instructions 
that affect the CPU execution state (e.g. HLT) and code or 
data segments from improper usage. These mechanisms are 
grouped under the term ''protection'’ and have three forms: 









Restricted usage of segments (e.g. no write allowed to read- 
only data segments). The only segments available for use 
are defined by descriptors in the Local Descriptor Table 
(LDT) and Global Descriptor Table (GDT). 


Restricted access to segments via the rules of privilege and 
descriptor usage. 


Privileged instructions or operations that may only be 
executed at certain privilege levels as determined by the 
CPL and |/O Privilege Level (IOPL). The IOPL is defined by 
bits 14 and 13 of the flag word. 


These checks are performed for all instructions and can be 
split into three categories: segment load checks (Table 10), 
operand reference checks (Table 11), and privileged instruc- 
tion checks (Table 12). Any violation of the rules shown will 
result in an exception. A not-present exception related to the 
stack segment causes exception 12. 


The IRET and POPF instructions do not perform some of their 
defined functions if CPL is not of sufficient privilege (numeri- 
cally small enough). No exceptions or other indication are 
given when these conditions occur. 


The IF bit is not changed if CPL > IOPL. 
The IOPL field of the flag word is not changed if 
CPL > 0. 
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Table 10. Segment Register Load Checks 


Table 12. Privileged Instruction Checks 


see Exception 
ieee eas ee i 
Anes E 
| __error Deseption | Number Error Description lee he 
Descriptor table limit exceeded Umber 
Segment descriptor not-present 11 or 12 ae ae when executing the following 
instructions: 
Privilege rules violated LIDT, LLOT, LGDT, LTR, LMSW, CTS, 
13 


Invalid descriptor/segment type segment HLT 
register load: CPL > IOPL when executing the following 
—Read only data segment load to SS instructions: 
—Special control descriptor load to DS, INS, IN, OUTS, OUT, STI, CLI, LOCK 
ES, SS 
—Execute only segment load to DS, ES, 
ss ‘ 
—Data segment load to CS Exceptions 
—Read/Execute code segment load to 
Ss The 80286 detects several types of exceptions and interrupts 


in protected mode (see Table 13). Most are restartable after 


Table 11. Operand Reference Checks the exceptional condition is removed. Interrupt handlers for 
most exceptions receive an error code, pushed on the stack 


a Exception after the return address, that identifies the selector involved (0 
beached if none). The return address normally points to the failing 
Write into code segment instruction, including all leading prefixes. For a processor 


Read from execute-only code segment extension segment overrun exception, the return address will 


Write to read-only data segment not point at the ESC instruction that caused the exception; 


3 imi neal however, the processor extension registers may contain the 
Sament mnilexcseds 12.0r'ds address of the failing instruction. 
Note 1: Carry out in offset calculations is ignored. 


Table 13. Protected Mode Exceptions 


Return 
Interrupt Address Always 
Vector At Failing Restartable? 
Instruction? 


Error 
Code 
on Stack? 


Double exception detected 

Processor extension segment overrun 

Invalid task state segment 

Segment not present 

Stack segment overrun or segment not present 
General protection 


Note 1: When a PUSHA or POPA instruction attempts to wrap around the stack segment, the machine state after the exception will not 
be restartable. This condition is identified by the value of the saved SP being either 0000(H), 0001(H), FFFE(H), or FFFF(H). 


All these checks are performed for all instructions and can be Task Register (TR). This register contains a selector referring 
split into three categories: segment load checks (Table 11), to the task state segment descriptor that defines the current 
operand reference checks (Table 12), and privileged instruc- TSS. A hidden base and limit register associated with TR are 
tion checks (Table 13). Any violation of the rules shown will loaded whenever TR is loaded with a new selector. 

result in an exception. A not-present exception related to the 


P The IRET instruction is used to return control to the task that 
stack segment causes exception 12. 


called the current task or was interrupted. Bit 14 in the flag 
Special Operations register is called the Nested Task (NT) bit. It controls the 
function of the IRET instruction. If NT = O, the IRET instruc- 
tion performs the regular current task return; when NT = 1, 
The 80286 provides a built-in task switch operation which IRET performs a task switch operation back to the previous 
saves the entire 80286 execution state (registers, address task. 


naae ats ent ie teen rea ean taatiel When a CALL or INT instruction initiates a task switch, the old 
SIBIE ANE COMMENCES: Cxecutlon. IN:he New: 12s (Ke gates; and new TSS will be marked busy and the back link field of the 
the task switch operation is invoked by executing an inter- new TSS set to the old TSS selector. The NT bit of the new 


segment JMP or CALL instruction which refers to a Task State task is set b jack : ; 
: ‘ y CALL or INT initiated task switches. An interrupt 
Segment (TSS) or task gate descriptor in the GDT or LDT. An that does not cause a task switch will clear NT. NT may Bee 


INT n instruction, exception, or external interrupt may also be set or cleared by POPF or IRET instructions. 
invoke the task switch operation by selecting a task gate 
descriptor in the associated IDT descriptor entry. The task state segment is marked busy by changing the 
i A ' descriptor type field from Type 1 to Type 3. Use of a selector 
The TSS descriptor points at a segment (see Figure 25) that references a busy task state segment causes Exception 
containing the entire 80286 execution state while a task gate 13 

descriptor contains a TSS selector. The limit field must : 

be > 002B(H). Processor Extension Context Switching 


Task Switch Operation 


Each task must have a TSS associated with it. The current The context of a processor extension is not changed by the 
TSS is identified by a special register in the 80286 called the task switch operation. A processor extension context need 
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only be changed when a different task attempts to use the 
processor extension (which still contains the context of a 
previous task). The 80286 detects the first use of a processor 
extension after a task switch by causing the processor 
extension not present exception (7). The interrupt handler may 
then decide whether a context change is necessary. 


Whenever the 80286 switches tasks, it sets the Task Switched 
(TS) bit of the MSW. TS indicates that a processor extension 
context may belong to a different task than the current one. 
The processor extension not present exception (7) will occur 
when attempting to execute an ESC or WAIT instruction if 
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TASK 
STATE 
SEGMENT 


TS=1 and a processor extension is present (MP=1 in 
MSW). 


Pointer Testing Instructions 


The 80286 provides several instructions to speed pointer 
testing and consistency checks for maintaining system integri- 
ty (see Table 14). These instructions use the memory manage- 
ment hardware to verify that a selector value refers to an 
appropriate segment without risking an exception. A condition 
flag indicates whether use of the selector or segment will 
cause an exception. 





AN AVAILABLE TASK STATE 
SEGMENT. MAY BE USEO AS 

THE DESTINATION OF A TASK 
SWITCH OPERATION. 


A BUSY TASK STATE SEGMENT. 
CANNOT BE USED AS THE 
DESTINATION OF A TASK 
SWITCH. 









0 |SEGMENT IS NOT PRESENT IN 
% MEMORY, BASE ANO LIMIT ARE NOT 
DEFINED 





28 | CURRENT 
TASK 
26 { STATE 





8 | INITIAL 
STACKS 
6 | FORCPL0,1,2 


DF003750 


Figure 25. Task State Segment and TSS Registers 
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Table 14. Pointer Test Instructions 


[instruction [Operands] Function ———*d 


ARPL 


VERR 
VERW 


Adjust Requested Privilege Level: 
adjusts the RPL of the selector to 
the numeric maximum of current 
selector RPL value and the RPL 
value in the register. Set zero flag 
if selector RPL was changed. 


Selector, 
Register 


VERify for Read: sets the zero 
flag if the segment referred to by 
the selector can be read. 


Selector 


VERify for Write: sets the zero 
flag if the segment referred to by 
the selector can be written. 


Selector 


Load Segment Limit: reads the 
segment limit into the register if 
privilege rules and descriptor type 
allow. Set zero flag if successful. 


Register, 
Selector 


Load Access Rights: reads the 
descriptor access rights byte into 
the register if privilege rules allow. 
Set zero flag if successful. 


Register, 
Selector 


Double Fault and Shutdown 


If two separate exceptions are detected during a single 
instruction execution, the 80286 performs the double fault 
exception (8). If an exception occurs during processing of the 
double fault exception, the 80286 will enter shutdown. During 
shutdown no further instructions or exceptions are processed. 
Either NMI (CPU remains in protected mode) or RESET (CPU 
exits protected mode) can force the 80286 out of shutdown. 
Shutdown is externally signalled via a HALT bus operation with 
Ay HIGH. 


Protected Mode Initialization 


The 80286 initially executes in real address mode after 
RESET. To allow initialization code to be placed at the top of 
physical memory, Ao3~-20 will be HIGH when the 80286 
performs memory references relative to the CS register, until 
CS is changed. A23 - 20 will be zero for references to the DS, 
ES, or SS segments. Changing CS in real address mode will 
force Agg3 - Az9 LOW whenever using CS thereafter. The initial 
CS:IP value of FFOO:FFFO provides 64K bytes of code space 
for initialization code without changing CS. 


Before placing the 80286 into protected mode, several regis- 
ters must be initialized. The GDT and IDT base registers must 
refer to a valid GDT and IDT. After executing the LMSW 
instruction to set PE, the 80286 must immediately execute an 
intrasegment JMP instruction to clear the instruction queue of 
instructions decoded in real address mode. 


To force the 80286 CPU registers to match the initial protected 
mode state assumed by software, execute a JMP instruction 
with a selector referring to the initial TSS used in the system. 
This will load the task register, local descriptor table register, 
segment registers and initial general register state. The TR 
should point at a valid TSS since a task switch operation 
involves saving the current task state. 


Multibus is a registered trademark of Intel Corporation. 
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System Interface 


The 80286 system interface appears in two forms: a local bus 
and a system bus. The local bus consists of address, data, 
status, and control signals at the pins of the CPU. A system 
bus is any buffered version of the local bus. A system bus may 
also differ from the local bus in terms of coding of status and 
control lines and/or timing and loading of signals. The 80286 
family includes several devices to generate standard system 
buses such as the IEEE 796 Standard Multibus!™. 


Bus Interface Signals and Timing 


The 80286 microsystem local bus interfaces the 80286 to 
local memory and 1/O components. The interface has 24 
address lines, 16 data lines, and 8 status and control signals. 


The 80286 CPU, 82284 clock generator, 82C288 bus control- 
ler, 82289 bus arbiter, 8286/7 transceivers, and 8282/3 
latches provide a buffered and decoded system bus interface. 
The 82284 generates the system clock and synchronizes 
READY and RESET. The 82C288 converts bus operation 
status encoded by the 80286 into command and bus control 
signals. These components can provide the timing and electri- 
cal power drive levels required for most system bus interfaces 
including the multibus. 


Physical Memory and I/O Interface 


A maximum of 16 megabytes of physical memory can be 
addressed in protected mode. One megabyte can be ad- 
dressed in real address mode. Memory is accessible as bytes 
or words. Words consist of any two consecutive bytes 
addressed with the least significant byte stored in the lowest 
address. 


Byte transfers occur on either half of the 16-bit local data bus. 
Even bytes are accessed over D7_o while odd bytes are 
transferred over D158. Even-addressed words are trans- 
ferred over D15-~0 in one bus cycle, while odd-addressed 
words require two bus operations. The first transfers data on 
Di5-~8, and the second transfers data on D7_9. Both byte 
data transfers occur automatically, transparent to software. 


Two bus signals, Ag and BHE, control transfers over the lower 
and upper halves of the data bus. Even address byte transfers 
are indicated by Ag LOW and BHE HIGH. Odd address byte 
transfers are indicated by Ag HIGH and BHE LOW. Both Ao 
and BHE are LOW for even address word transfers. 


The I/O address space contains 64K addresses in both 
modes. The I/O space is accessible as either bytes or words, 
as is memory. Byte wide peripheral devices may be attached 
to either the upper or lower byte of the data bus. Byte-wide I/O 
devices attached to the upper data byte (Dj5_) are ac- 
cessed with odd I/O addresses. Devices on the lower data 
byte are accessed with even I/O addresses. An interrupt 
controller such as the 8259A must be connected to the lower 
data byte (D7~0) for proper return of the interrupt vector. 


Bus Operation 


The 80286 uses a double frequency system clock (CLK input) 
to control bus timing. All signals on the local bus are measured 
relative to the system CLK input. The CPU divides the system 
clock by 2 to produce the internal processor clock, which 
determines bus state. Each processor clock is composed of 
two system clock cycles named phase 1 and phase 2. The 
82284 clock generator output (PCLk) identifies the next phase 
of the processor clock. (See Figure 26.) 











ONE PROCESSOR CLOCK CYCLE 
ONE BUS T STATE 


PHASE 1 


PHASE 2 


OF PROCESSOR —>{«—OF PROCESSOR 
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Figure 26. System and Processor Clock Relationships 


Six types of bus operations are supported: memory read, 
memory write, !/O read, I/O write, interrupt acknowledge, and 
halt/shutdown. Data can be transferred at a maximum rate of 
one word per two processor clock cycles. 


The 80286 bus has three basic states: idle (Tj), send status 
(Ts), and perform command (Tc). The 80286 CPU also has a 


HLDA e NEW CYCLE 


fourth local bus state called hold (Tp). Th indicates that the 
80286 has surrendered control of the local bus to another bus 
master in response to a HOLD request. 


Each bus state is one processor clock long. Figure 27 shows 
the four 80286 local bus states and allowed transitions. 


NEW CYCLE e HLDA 


READY e NEW CYCLE 


AF003240 


Figure 27. 80286 Bus States 


Bus States 


The idle (Tj) state indicates that no data transfers are in 
progress or requested. The first active state, Ts, is signalled by 
either status line ST or SO going LOW also identifying phase 1 
of the processor clock. During Ts, the command encoding, the 
address, and data (for a write operation) are available on the 
80286 output pins. The 82C288 bus controller decodes the 
status signals and generates Multibus compatible read/write 
command and local transceiver control signals. 


After Ts, the perform command (T,) state is entered. Memory 
or |/O devices respond to the bus operation during Tg, either 
transferring read data to the CPU or accepting write data. T> 
states may be repeated as often as necessary to assure 
sufficient time for the memory or I/O device to respond. The 
READY signal determines whether Tc, is repeated. 


During hold (Th), the 80286 will float all address, data, and 
status output pins, enabling another bus master to use the 
local bus. The 80286 HOLD input signal is used to place the 
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80286 into the Tp state. The 80286 HLDA output signal 
indicates that the CPU has entered Tp. 


Pipelined Addressing 


The 80286 uses a local bus interface with pipelined timing to 
allow as much time as possible for data access. Pipelined 
timing allows bus operations to be performed in two processor 
cycles, while allowing each individual bus operation to last for 
three processor cycles. 


The timing of the address outputs is pipelined such that the 
address of the next bus operation becomes available during 
the current bus operation. Or in other words, the first clock of 
the next bus operation is overlapped with the last clock of the 
current bus operation. Therefore, address decode and routing 
logic can operate in advance of the next bus operation. 
External address latches may hold the address stable for the 
entire bus operation and provide additional AC and DC 
buffering. 








READ CYCLEN REAO CYCLE N+1 
an | ——__—_—— T5 ——____»> | _—_—_ Te >|<4-——_-—Ts > | <$——$$_——_- t>. ——__—_ 
ol 1 o2 ol ' o2 ot | o2 o1 | o2 


















CLK 








A q Lh \ LS x LS 
t 
PROC CLK 
-—_———_ 2 CLOCK CYCLE TRANSFER — | 2 CLOCK Cycle TRANSFER ——~+--——_ 
—— 2.5 CLOCK CYCLE ADDRESS TO DATA VALIO -— + — ——| 


oe <TD, CS 


(SS LL 








VALIO READ VALID READ 
DATA (N) DATA (N+ 1) 
WF007840 


Figure 28. Basic Bus Cycle 





The 80286 does not maintain the address of the current bus Command Timing Controls 
operation during all Tc states. Instead, the address for the next 
bus operation may be emitted during phase 2 of any Tc. The 
address remains valid during phase 1 of the first Tc to 


Two system timing customization options, command exten- 
sion and command delay, are provided on the 80286 local 


guarantee hold time, relative to ALE, for the address latch bus. 

inputs. Command extension allows additional time for external de- 
‘ vices to respond to a command and is analogous to inserting 

Bus Control Signals wait states on the 8086. External logic can control the duration 


of any bus operation such that the operation is only as long as 
necessary. The READY input signal can extend any bus 
operation for as long as necessary. 


The 82C288 bus controller provides control signals: address 
latch enable (ALE), Read/Write commands, data transmit/ 
receive (DT/R), and data enable (DEN) that contro! the 








address latches, data transceivers, write enable, and output Command delay allows an increase of address or write data 
enable for memory and I/O systems. set-up time to system bus command active for any bus 
operation by delaying when the system bus command be- 
The Address Latch Enable (ALE) output determines when the comes active. Command delay is controlled by the 82C288 
address may be latched. ALE provides at least one system CMDLY input. After Ts, the bus controller samples CMDLY at 
CLK period of address hold time from the end of the previous each failing edge of CLK. If CMDLY is HIGH, the 820288 will 
bus operation until the address for the next bus operation not activate the command signal. When CMDLY is LOW, the 
appears at the latch outputs. This address hold time is 82C288 will activate the command signal. After the command 
required to support Multibus® and common memory systems. becomes active, the CMDLY input is not sampled. 
The data bus transceivers are controlled by 82C288 outputs When a command is delayed, the available response time 
Data Enable (DEN) and Data Transmit/Receive (DT/R). DEN from command active to return read data or accept write data 
enables the data transceivers while DT/R controls transceiver is less. To customize system bus timing, an address decoder 
direction. DEN and DT/R are timed to prevent bus contention can determine which bus operations require delaying the 
between the bus master, data bus transceivers, and system command. The CMDLY input does not affect the timing of 
data bus transceivers. ALE, DEN, or DT/R. 
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Figure 29. CMDLY Controls and Leading Edge of the Command 


Figure 29 illustrates four uses of CMDLY. Example 1 shows 
delaying the read command two system CLKs for cycle N-1 
and no delay for cycle N, and example 2 shows delaying the 
read command one system CLK for cycle N-1 and one system 
CLK delay for cycle N. 


Bus Cycle Termination 


At maximum transfer rates, the 80286 bus alternates between 
the status and command states. The bus status signals 
become inactive after T, so that they may correctly signal the 
start of the next bus operation after the completion of the 
current cycle. No external indication of T, exists on the 80286 
local bus. The bus master and bus controller enter T, directly 
after Ts and continue executing T¢ cycles until terminated by 
READY. 


READY Operation 


The current bus master and 82C288 bus controller terminate 
each bus operation simultaneously to achieve maximum bus 
bandwidth. Both are informed in advance by READY active 
which identifies the last T, cycle of the current bus operation. 
The bus master and bus controller must see the same sense 
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of the READY signal, thereby requiring READY be synchro- 
nous to the system clock. 


Synchronous Ready 


The 82284 clock generator provides READY synchronization 
from both synchronous and asynchronous sources (see Fig- 
ure 30). The synchronous ready input (SRDY) of the clock 
generator is sampled with the falling edge of CLK at the end of 
phase 1 of each Tg. The state of SRDY is then broadcast to 
the bus master and bus controller via the READY output line. 


Asynchronous Ready 


Many systems have devices or subsystems that are asynchro- 
nous to the system clock. As a result, their ready outputs 
cannot be guaranteed to meet the 82284 SRDY set-up and 
hold time requirements. The 82284 asynchronous ready input 
(ARDY) is designed to accept such signals. The ARDY input is 
sampled at the beginning of each Tg. cycle by 82284 synchro- 
nization logic. This provides a system CLK cycle time to 
resolve its value before broadcasting it to the bus master and 
bus controller. 
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Figure 30. Synchronous and Asynchronous Ready 


Notes: 1. SRDYEN is active LOW. 


2. If SRDYEN is HIGH, the state of SRDY will not effect READY. 


3. ARDYEN is active LOW. 


Each ready input of the 82284 has an enable pin (SRDYEN 
and ARDYEN) to select whether the current bus operation will 
be terminated by the synchronous or asynchronous. ready. 
Either of the ready inputs may terminate a bus operation. 
These enable inputs are active low and have the same timing 
as their respective ready inputs. Address decode logic usually 
selects whether the current bus operation should be terminat- 
ed by ARDY or SRDY. 


Data Bus Control 


Figures 31, 32, and 33 show how the DT/R, DEN, data bus, 
and address signals operate for different combinations of 
read, write, and idle bus operations. DT/R goes active (LOW) 
for a read operation. DT/R remains HIGH before, during, and 
between write operations. 


The data bus is driven with write data during the second phase 
of Ts. The delay in write data timing allows the read data 
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drivers, from a previous read cycle, sufficient time to enter 
three-state OFF before the 80286 CPU begins driving the local 
data bus for write operations. Write data will always remain 
valid for one system clock past the last T, to provide sufficient 
hold time for Multibus or other similar memory or I/O systems. 
During write-read or write-idle sequences the data bus enters 
three-state OFF during the second phase of the processor 
cycle after the last Tg. In a write-write sequence the data bus 
does ‘not enter three-state OFF between Tg and Ts. 


Bus Usage 


The 80286 local bus may be used for several functions: 
instruction data transfers, data transfers by other bus masters, 
instruction fetching, processor extension data transfers, inter- 
rupt acknowledge, and halt/shutdown. This section describes 
local bus activities which have special signals or requirements. 
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Figure 31. Back-to-Back Read-Write Cycles 
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Figure 32. Back-to-Back Write-Read Cycles 
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HOLD and HLDA 





HOLD and HLDA allow another bus master to gain control of 
the local bus by placing the 80286 bus into the Tp state. The 
sequence of events required to pass control between the 
80286 and another local bus master are shown in Figure 34. 


In this example, the 80286 is initially in the Tp, state as 
signaled by HLDA being active. Upon leaving Tp, as signaled 
by HLDA going inactive, a write operation is started. During the 
write operation another local bus master requests the local 
bus from the 80286 as shown by the HOLD signal. After 
completing the write operation, the 80286 performs one Tj bus 
cycle, to guarantee write data hold time, then enters Th as 
signaled by HLDA going active. 


The CMDLY signal and ARDY ready are used to start and stop 
the write bus command, respectively. Note that SRDY must be 
inactive or disabled by SRDYEN to guarantee ARDY will 
terminate the cycle. 








Instruction Fetching 


The 80286 Bus Unit (BU) will fetch instructions ahead of the 
current instruction being executed. This activity is called 
prefetching. It occurs when the local bus would otherwise be 
idle and obeys the following rules: 
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Figure 33. Back-to-Back Write-Write Cycles 
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A prefetch bus operation starts when at least two bytes of the 
6-byte prefetch queue are empty. 


The prefetcher normally performs word prefetches indepen- 
dent of the byte alignment of the code segment base in 
physical memory. 


The prefetcher will perform only a byte code fetch operation 
for control transfers to an instruction beginning on a numeri- 
cally odd physical address. 


Prefetching stops whenever a control transfer or HLT instruc- 
tion is decoded by the IU and placed into the instruction 
queue. 


In real address mode, the prefetcher may fetch up to 5 bytes 
beyond the last control transfer or HLT instruction in a code 
segment. 


In protected mode, the prefetcher will never cause a segment 
overrun exception. The prefetcher stops at the last physical 
memory word of the code segment. Exception 13 will occur if 
the program attempts to execute beyond the last full instruc- 
tion in the code segment. 


If the last byte of a code segment appears on an even physical 
memory address, the prefetcher will read the next physical 
byte of memory (perform a word code fetch). The value of this 
byte is ignored and any attempt to execute it causes exception 
13. 
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Figure 34. Multibus Write Terminated by Asynchronous Ready with Bus Hold 


Notes: 1. Status lines are not driven by 80286, yet remain high due to pull-up resistors in 82C288 and 82289 during 
HOLD state. 


2. Address, M/IO and COD/INTA may start floating during any TC depending on when internal 80286 bus arbiter 
decides to release bus to external HOLD. The float starts in ¢2 of TC. 


. BHE and LOCK may start floating after the end of any TC depending on when internal 80286 bus arbiter 
decides to release bus to external HOLD. 


. The minimum HOLD | to HLDA | time is shown. Max.imum is one Ty longer. 
. The earliest HOLD 1 time is shown which will always allow a subsequent memory cycle if pending. 


. The minimum HOLD t to HLDA 1 time is shown. Max.imum is a function of the instruction, type of bus cycle 
and other machine status (i.e., Interrupts, Waits, Lock, etc.) 


. Asynchronous ready allows termination of the cycle. Synchronous ready does not signal ready in this example. 
Synchronous ready state is ignored after ready is signaled via the asynchronous input. 
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Processor Extension Transfers 





The processor extension interface uses I/O port addresses 
OOF8(H), OOFA(H), and OOFC(H) which are part of the I/O port 
address range and is a reserved area. An ESC instruction with 
EM = 0 and TS = 0 will perform I/O bus operations to one or 
more of these I/O port addresses independent of the value of 
IOPL and CPL. 


ESC instructions with memory references enable the CPU to 
accept PEREQ inputs for processor extension operand trans- 
fers. The CPU will determine the operand starting address and 
read/write status of the instruction. For each operand transfer, 
two or three bus operations, one word transfer with I/O port 
address 00FA(H), and one or two bus operations with memory 
are performed. Three bus operations are required for each 
word operand aligned on an odd byte address. 


Interrupt Acknowledge Sequence 


Figure 35 illustrates an interrupt acknowledge sequence 
performed by the 80286 in response to an INTR input. An 
interrupt acknowledge sequence consists of two INTA bus 
operations. The first allows a master 8259A Programmable 
Interrupt Controller (PIC) to determine which if any of its slaves 
should return the interrupt vector. An eight bit vector is read by 
the 80286 during the second INTA bus operation to select an 
interrupt handler routine from the interrupt table. 


The Master Cascade Enable (MCE) signal of the 82C288 is 
used to enable the cascade address drivers, during INTA bus 
operations (see Figure 35), onto the local address bus for 
distribution to slave interrupt controllers via the system ad- 
dress bus. The 80286 emits the LOCK signal (active LOW) 
during Ts of the first INTA bus operation. A local bus "hold" 
request will not be honored until the end of the second INTA 
bus operation. 





Three idle processor clocks are provided by the 80286 
between INTA bus operations to allow for the minimum INTA 
to INTA time and CAS (cascade address) out delay of the 
8259A. The second INTA bus operation must always have at 
least one extra Te state added via logic controlling READY. 
Ag3 - Ao are in three-state OFF until after the first T, state of 
the second INTA bus operation. This prevents bus contention 
between the cascade address drivers and CPU address 








31 


drivers. The extra Tg state allows time for the 80286 to resume 
driving the address lines for subsequent bus operations. 


Local Bus Usage Priorities 


The 80286 local bus is shared among several internal units 
and external HOLD requests. In case of simultaneous re- 
quests, their relative priorities are: 


(Highest) Any transfers which assert LOCK either ex- 
plicitly (via the LOCK instruction prefix) or 
implicitly (i.e., segment descriptor access, in- 
terrupt acknowledge sequence, or an XCHG 
with memory). 


The second of the two byte bus operations 
required for an odd aligned word operand. 


Local bus request via HOLD input. 


Processor extension data operand transfer 
via PEREQ input. 


Data transfer performed by EU as part of an 
instruction. 


An instruction prefetch request from BU. The 
EU will inhibit prefetching two processor 
clocks in advance of any data transfers to 
minimize waiting by EU for a prefetch to fin- 
ish. 


(Lowest) 


Halt or Shutdown Cycles 


The 80286 externally indicates halt or shutdown conditions as 
a bus operation. These conditions occur due to a HLT 
instruction or multiple protection exceptions while attempting 
to execute one instruction. A halt or shutdown bus operation is 
signalled when S1, SO and COD/INTA are LOW and M/O is 
HIGH. Az HIGH indicates halt, and Ay LOW indicates shut- 
down. The 82C288 bus controller does not issue ALE, nor is 
READY required to terminate a halt or shutdown bus opera- 
tion. 


During halt or shutdown, the 80286 may service PEREQ or 
HOLD requests. A processor extension segment overrun 
exception during shutdown will inhibit further service of PER- 
EQ. Either NMI or RESET will force the 80286 out of either halt 
or shutdown. An INTR, if interrupts are enabled, or a proces- 
sor extension segment overrun exception will also force the 
80286 out of halt. 
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Figure 35. Interrupt Acknowledge Sequence 


Notes: 1. Data is ignored. 
2. First INTA cycle should have at least one wait state inserted to meet 8259A minimum INTA pulse width. 
3. Second INTA cycle must have at least one wait state inserted since the CPU will not drive Ag3-Ao, BHE, and 
LOCK until after the first TC state. 
The CPU imposed one/clock delay prevents bus contention between cascade address buffer being disabled by 
MCE | and address outputs. 
Without the wait state, the 80286 address will not be valid for a memory cycle started immediately after the 
second INTA cycle. The 8259A also requires one wait state for minimum INTA pulse width. 
. LOCK is active for the first INTA cycle to prevent the 82289 from releasing the bus between INTA cycles in a 
multi-master system. 
. Ao3- Ap exits three-state OFF during $2 of the second Tg in the INTA cycle. 
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Figure 36. Basic 80286 System Configuration 


System Configurations 


The versatile bus structure of the 80286 microsystem, with a 
full complement of support chips, allows flexible configuration 
of a wide range of systems. The basic configuration, shown in 
Figure 36, is similar to an iAPX 86 maximum mode system. It 
includes the CPU plus an 8259A interrupt controller, 82284 
clock generator, and the 82C288 Bus Controller. The iAPX 86 
latches (29843 and 29845) and transceivers (29833 and 
29863) may be used in an 80286 microsystem. 


As indicated by the dashed lines in Figure 36, the ability to add 
processor extensions is an integral feature of 80286 microsys- 
tems. The processor extension interface allows external 
hardware to perform special functions and transfer data 
concurrent with CPU execution of other instructions. Full 
system integrity is maintained because the 80286 supervises 
all data transfers and instruction execution for the processor 
extension. 


The 80286 with the 80287 numeric processor extension (NPX) 
uses this interface. The iAPX 286/287 has all the instructions 
and data types of an iAPX 86/87 or iAPX 88/87. The 80287 
NPX can perform numeric calculations and data transfers 
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concurrently with CPU program execution. Numerics code and 
data have the same integrity as all other information protected 
by the 80286 protection mechanism. 


The 80286 can overlap chip select decoding and address 
propagation during the data transfer for the previous bus 
operation. This information is latched into the 29843/45's by 
ALE during the middle of a Ts cycle. The latched chip select 
and address information remains stable during the bus opera- 
tion while the next cycle's address is being decoded and 
propagated into the system. Decode logic can be imple- 
mented with a high-speed bipolar PROM. 


The optional decode logic shown in Figure 36 takes advan- 
tage of the overlap between address and data of the 80286 
bus cycle to generate advanced memory and |/O-select 
signals. This minimizes system performance degradation 
caused by address propagation and decode delays. In addi- 
tion to selecting memory and I/O, the advanced selects may 
be used with configurations supporting local and system buses 
to enable the appropriate bus interface for each bus cycle. 
The COD/INTA and M/IO signals are applied to the decode 
logic to distinguish between interrupt, |/O, code and data bus 
cycles. 
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Figure 37. Multibus System Bus Interface 


By adding the 82289 bus arbiter chip, the 80286 provides a 
Multibus system bus interface as shown in Figure 37. The ALE 
output of the 82C288 for the Multibus bus is connected to its 
CMDLY input to delay the start of commands one system CLK 
as required to meet Multibus address and write data set-up 
times. This arrangement will add at least one extra T, state to 
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each bus operation which uses the Multibus. 


A second 82C288 bus controller and additional latches and 
transceivers could be added to the local bus of Figure 37. This 
configuration allows the 80286 to support an on-board bus for 
local memory and peripherals and the Multibus for system bus 
interfacing. 
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Figure 38. 80286 Interface with the Am2968 Dynamic Memory Controller 


Figure 38 shows the interface of the 80286 with the Am2968 
Dynamic Memory Controller. The interface is a timing control- 
ler which consists of some control logic and a delay line. The 
timing controller runs asynchronously to the CPU. It arbitrates 
between memory requests and refresh requests by generating 


the proper signals to the dynamic memory controller and 
memory. The design described is a simple, cost-effective 
solution to interfacing the 80286 with the Am2968. A further 
description about DRAM selection based on processor speed 
may be found in the Am2968 Application Note. 


Table 15. 80286 Systems Recommended Pull-up Resistor Values 


80286 Pin and Name Pull-up Value 


zak 1% 
6 — PEACK 
53 — ERROR 20KQ2t 10% 


54 — BUSY 
63 — READY 


91024+5% 


Instruction Set 


The instruction set is divided into seven categories: data 
transfer, arithmetic, shift/rotate/logical, string manipulation, 
control transfer, high level instructions, and processor control. 
These categories are summarized in Figures 3-9. 


An 80286 instruction can reference zero, one, or two operands 
where an operand resides in a register, in the instruction itself, 
or in memory. Zero-operand instructions (e.g., NOP and HLT) 
are usually one byte long. One-operand instructions (e.g., INC 
and DEC) are usually two bytes long, but some are encoded in 


Purpose 


Pull SO, S1, and PEACK inactive during 80286 hold periods. 





Pull ERROR and BUSY inactive when 80287 not present (or temporarily 
removed from socket). 


Pull READY inactive within required minimum time (C, = 150pF, IR <7mA). 
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only one byte. One-operand instructions may reference a 
register or memory location. Two-operand instructions permit 
the following six types of instruction operations: 


- Register to Register 
-Memory to Register 
-Immediate to Register 
—Memory to Memory 
— Register to Memory 
-Immediate to Memory 





Two-operand instructions (e.g. MOV and ADD) are usually 
three to six bytes long. Memory-to-memory operations are 


provided by a special class of string instructions requiring one 
to three bytes. 


REGISTER OPERAND/REGISTERS TO USE IN OFFSET CALCULATION 
REGISTER OPERAND/EXTENSION OF OPCODE 
REGISTER MODE/MEMORY MODE WITH DISPLACEMENT LENGTH 


WORD/BYTE OPERATION 


DIRECTION IS TO REGISTER/DIRECTION IS FROM REGISTER 
OPERATION (INSTRUCTION) CODE 


A. SHORT OPCODE FORMAT EXAMPLE 


BYTE! BYTE2 BYTE 3 


DF003760 


765432107654321076543210 


B. LONG OPCODE FORMAT EXAMPLE 


DF003770 


Figure 39. 80286 Instruction Format Examples 


80286 INSTRUCTION SET SUMMARY 
Instruction Timing Notes 


The instruction clock counts listed below establish the maxi- 
mum execution rate of the 80286. With no delays in bus 
cycles, the actual clock count of an 80286 program will 
average 5% more than the calculated clock count, due to 
instruction sequences which execute faster than they can be 
fetched from memory. 


To calculate elapsed times for instruction sequences, multiply 
the sum of all instruction clock counts, as listed in the table 
below, by the processor clock period. An 8 MHz processor 
clock has a clock period of 125 nanoseconds and requires an 
80286 system clock (CLK input) of 16 MHz. 


Instruction Clock Count Assumptions 

1. The instruction has been prefetched, decoded, and is ready 
for execution. Control transfer instruction clock counts 
include all time required to fetch, decode, and prepare the 
next instruction for execution. 


2. Bus cycles do not require wait states. 


3. There are no processor extension data transfer or local bus 
HOLD requests. 


4. No exceptions occur during instruction execution. 


Instruction Set Summary Notes 


Addressing displacements selected by the MOD field are not 
shown. If necessary they appear after the instruction fields 
shown. 


Above/below refers to unsigned value 
Greater refers to positive signed value 
Less refers to less positive (more negative) signed values 


if d=1 then to register; if d=0 then from register 


if w=1 then word instruction; if w=0 then byte instruc- 
tion 


if s=0 then 16-bit immediate data to form the operand 


if s=1 then an immediate data byte is sign-extended to 
form the 16-bit operand 


x = don't care 
z= used for string primitives for comparison with ZF FLAG 


If two clock counts are given, the smaller refers to a register 
operand and the larger refers to a memory operand. 


*= add one clock if offset calculation requires summing 3 
elements 


n= number of times repeated 
m=number of bytes of code in next instruction 
Level (L)—Lexical nesting level of the procedure 


The following comments describe possible exceptions, side 


effects, and allowed usage for instructions in both operating 
modes of the 80286. 


Real Address Mode Only 


1. This is a protected mode instruction. Attempted execution in 
real address mode will result in an undefined opcode 
exception (6). 


2.A segment overrun exception (13) will occur if a word 
operand reference at offset FFFF(H) is attempted. 


3. This instruction may be executed in real address mode to 
initialize the CPU for protected mode. 


4.The IOPL and NT fields will remain 0. 


5. Processor extension segment overrun interrupt (9) will 
occur if the operand exceeds the segment limit. 





Either Mode 


6. An exception may occur, depending on the value of the 
operand. 


7. LOCK is automatically asserted regardless of the presence 
or absence of the LOCK instruction prefix. 


Protected Virtual Address Mode Only 


8.The destination of an INT, JMP, CALL, RET or IRET 
instruction must be in the defined limit of a code segment or 
a general protection exception (13) occurs. 


9. A general protection exception (13) will occur if the memory 
operand cannot be used due to either a segment limit or 
access rights violation. If a stack segment limit is violated, a 
stack segment overrun exception (12) occurs. 


10. For segment load operations, the CPL, RPL, and DPL must 
agree with privilege rules to avoid an exception. The 
segment must be present to avoid a not-present exception 
(11). If the SS register is the destination, and a segment 
not-present violation occurs, a stack exception (12) oc- 
curs. 


. All segment descriptor accesses in the GDT or LDT made 
by this instruction will automatically assert LOCK to 
maintain descriptor integrity in multiprocessor systems. 
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12. JMP, CALL, INT, RET, IRET instructions referring to 
another code segment will cause a general protection 
exception (13) if any privilege rule is violated. 


. A general protection exception (13) occurs if CPL #0. 
A general protection exception (13) occurs if CPL > IOPL. 


The IF field of the flag word is not updated if CPL > IOPL. 
The IOPL field is updated only if CPL =0. 


. Any violation of privilege rules as applied to the selector 
operand do not cause a protection exception; rather, the 
instruction does not return a result and the zero flag is 
cleared. 


. lf the starting address of the memory operand violates a 
segment limit, or an invalid access is attempted, a general 
protection exception (13) will occur before the ESC instruc- 
tion is executed. A stack segment overrun exception (12) 
will occur if the stack limit is violated by the operand's 
starting address. If a segment limit is violated during an 
attempted data transfer then a processor extension seg- 
ment overrun exception (9) occurs. 


. The destination of an INT, JMP, CALL, RET, or IRET 
instruction must be in the defined limit of a code segment 
or a general protection exception (13) will occur. 





80286 INSTRUCTION SET SUMMARY 


COMMENTS 


FUNCTION 


DATA TRANSFER 
MOV = Move: 


Register to Register/Memory 
Register/memory to register 
Immediate to register/memory 
Immediate to register 

Memory to accumulator 

Accumulator to memory 
Register/memory to segment register 
Segment register to register/memory 


PUSH = Push: 
Memory 


Register 


Segment register 


POP = Pop: 
Memory 


Register 

Segment register 
A= Pop All 

XCHG = Exchange: 


Register/memory with register 
Register with accumulator 


IN = Input from: 
Fixed port 


Variable port 


OUT = Output to: 
Fixed port 


Variable port 

XLAT = Translate byte to AL 
LEA = Load EA to register 
LDS = Load pointer to DS 
LES = Load pointer to ES 
LAHF = Load AH with flags 
SAHF = Store AH into flags 
PUSHF = Push flags 


POPF = Pop flags 


FORMAT 


1000100w mod reg r/m 


1000101w mod reg r/m 
1100011wY]|mod000 t/m 
1011w g 


1010000w addr-low 


LEE 


1010001w addr-low 


100011101] modOreg r/m 


10001100 mod 0 reg r/m 


1111114144 mod110 ¢/m 
01010 reg 


000reg110 


10001111 mod 0 0 0 r/m 


01011 = reg 


000reg111 (reg #01) 


1000011w mod reg r/m 


10010 reg 


1110010w 


1110110w 


1110011w 
1110111w 
11010111 


100011014 mod reg r/m 


11000101 mod reg r/m 


11000100 mod reg r/m 
10011111 
10011110 


10011100 


data if w=1 
addr-high 


addr-high 


(mod # 11) 


(mod # 11) 


data if w=1 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 


All mnemonics copyright Intel Corp., 1983. 
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CLOCK COUNT 


Protected 
Virtual 
Address 
Mode 


Real 
Address 
Mode 


Protected 
Virtual 
Address 
Mode 


9,10,11 


9,10,11 





80286 INSTRUCTION SET SUMMARY (Continued) 


Protected Protected 
Real Virtual Real Virtual 
Address | Address | Address | Address 
FUNCTION FORMAT Mode Mode Mode Mode 


ARITHMETIC 
ADD = Add: 


Reg/memory with register to either oo00000dw mod reg r/m 


mod 0 0 0 r/m 


Immediate to register / memory 100000sw 


Immediate to accumulator 0000010w 
ADC = Add with carry: 


Reg/memory with register to either 000100dw mod reg r/m 


mod 0 1 0 r/m data if s:w=01 


data if sw =01 


Immediate to register/memory 100000sw 


Immediate to accumulator 0001010w 
INC = Increment: 


Register/memory 111111414WwY] mod 000 r/m 


Register 01000 reg 
SUB = Subtract: 


Reg/memory and register to either 001010dw mod reg r/m 


mod 10 1 r/m data if sw =01 


data data if w=1 


Immediate from register/memory 100000sw 
Immediate from accumulator 0010110w 
SBB = Subtract with borrow: 
Reg/memory and register to either 000110dw 


mod reg r/m 


mod 0 1 1 r/m data if sw =01 


Immediate from register/memory 100000sw 
Immediate from accumulator 0001110w 
DEC = Decrement: 
Register/memory mod 0 0 1 r/m 
Register 

CMP = Compare: 


Register/memory with register 0011101Ww mod reg r/m 


Register with register/memory 0011100w mod reg r/m 


Immediate with register/memory 100000sw]| mod11114/m data if s:w=01 


Immediate with accumulator 0011110w data 


NEG = Change sign 111101414w] mod011¢r/m 
AAA = ASCII adjust for add 00110111 
DAA = Decimal! adjust for add 00100111 


AAS = ASCII adjust for subtract 001111141 


DAS = Decimal adjust for subtract 00101111 


MUL = Mulitiply (unsigned) mod 1 0 0 r/m 


Register-Byte 
Register-Word 
Memory-Byte 
Memory-Word 


mod 10 11/m 


Integer multiply (signed): 11417011w 


Register-Byte 
Register-Word 
Memory-Byte 
Memory-Word 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 





All mnemonics copyright Intel Corp., 1983. 
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80286 INSTRUCTION SET SUMMARY (Continued) 


CLOCK COUNT COMMENTS 


Protected Protected 
Real Virtual Real Virtual 
Address | Address | Address | Address 
FUNCTION FORMAT Mode Mode Mode 


ARITHMETIC (Continued) 
ne) 

DIV = Divide (unsigned): 111101141w 
Register-Byte 
Register-Word 


Memory-Byte 
Memory-Word 


IDIV = Integer divide (signed): 17111011Ww 


Register-Byte 
Register-Word 
Memory-Byte 
Memory-Word 


AAM = ASCII adjust for multiply 11010100 


mod 110 r/m 


mod 111 r/m 


00001010 


AAD =ASCIl adjust for divide 11010101/00001010 


CBW =Convert byte to word 10011000 
CWD = Convert word to double word 10011001 


LoGiIc 
Shift/Rotate Instructions: 


Register/Memory by 1 1101000w mod TTT r/m 


Register/Memory by CL mod TTT r/m 


Register/Memory by Count 11100000w| mod TIT r/m | | 
Instruction 
ROL 
ROR 
RCL 
RCR 
SHL/SAL 
SHR 
SAR 


4 


a4320000 
~ooA300 
4-AcA0o+0 


AND = And: 


Reg/memory and register to either 001000dw mod reg r/m 


Immediate to register/memory 1000000w| mod 100 r/m 


Immediate to accumulator 0010010w data data if w=1 


- TEST = And function to flags, no result: 


Register/memory and register 1000010w mod reg r/m 


Immediate data and register/memory 11110114WwYI{ mod000r/m data if w=1 


data if w=1 


Immediate data and accumulator 1010100w data if w=1 


OR = Or: 


Reg/memory and register to either 000010dw 


mod 0 0 1 r/m 


Immediate to register/memory 1000000w data data if w=1 


immediate to accumulator 0000110w data if w=1 
XOR = Exclusive or: 
Reg/memory and register to either 001100dw mod reg r/m 


mod 1 1 0 r/m data if w=1 


Immediate to register/memory 1000000w 


Immediate to accumulator 0011010w 


NOT = Invert register/memory 1111011W] mod010r/m 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 
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80286 INSTRUCTION SET SUMMARY (Continued) 





FUNCTION 
STRING MANIPULATION: 


FORMAT 


MOVS = Move byte/word 1010010w 


CMPS = Compare byte/word 1010011Ww 
SCAS = Scan byte/word 1010111Ww 
LODS = Load byte/wd to AL/AX 


STOS = Stor byte/wd from AL/A 1010101w 





INS = Input byte/wd from DX port 0110110w 


tput byte/wd to DX port 







count in CX 
Move string 111100104/1010010Ww 


CMPS = Compare string 411411001z/1010011Ww 


SCAS = Scan string 1010111w 


11110010 





LODS = Load string 


STOS = Store string 11110010/1010101WwW 





11110010/0110110w 


411110010/0110111W 





CALL = Call: 


Direct within segment 11101000 disp-high 





| 


4479711111 mod 0 1 0 r/m 


10011010 segment offset 


segment selector 


Register memory 
indirect within segment 


Direct intersegment 


Protected Mode Only (Direct intersegment): 

- Via call gate to same privilege level 
Via call gate to different privilege level, no parameters 
Via call gate to different privilege level, x parameters 
Via TSS 
Via task gate 

11411111 


Indirect intersegment mod 011 r/m (mod # 11) 


Protected Mode Only (Indirect Intersegment): 
Via call gate to same privilege level 
Via call gate to different privilege level, no parameters 
Via call gate to different privilege level, x parameters 
Via TSS F 
Via task gate 


JMP = Unconditional jump: 


Short/long 11101011 


Direct within segment 11101001 disp-high 


Register/memory indirect within segment 141111411 mod 10 0 r/m 


Direct intersegment 11101010 segment affset 


segment selector 


Protected Mode Only (Direct Intersegment): 
Via call gate to same privilege level 
Via TSS 
Via task gate 


Indirect intersegment 11417111 mod 1 0 1 r/m (mod # 11) 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 
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CLOCK COUNT COMMENTS 


Protected Protected 
Real Virtual Real Virtual 
Address | Address | Address | Address 
Mode Mode Mode Mode 





5 5 2 9 
8 8 2 9 
7 7 2 9 
5 5 2 9 
3 3 2 9 
5 5 2 9,14 
5 5 2 9,14 
5+4n 5+4n 2 9 
5+9n 5+9n 2 9 
5+8n 5+8n 2 9 
5+4n §+4n 2 9 
4+3n 4+3n 2 9 
5+4n 5+4n 2 9,14 
5+4n 5+4n 2 

















7+m 7+m 2 8 
7+m,11+m| 7+mit+m 2 8,9 
138+m 26+m 2 8,11,12 
41+m 811,12 
82+m B,11,12 
86 + 4x +m 811,12 
177+m 811,12 
182+m 8,11,12 
16+m | 29+m" 2 8,9,11,12 
444m" 8,9,11,12 
83 +m* 8,9,11,12 
90 + 4x +m 8,9,11,12 
180 + m* 8,9,11,12 
185 + m* 8,9,11,12 
7+m 7+m 8 
7+m 7+m 8 
7+mitem| 7+mi1+m| 2 8,9 
+m 23+m 8,11,12 
38+m 814,12 
175+m 811,12 
180 +m 8,11,12 
15+m' | 26+m" 2 8,9,11,12 














CLOCK COUNT 


Protected 





















Real Virtual 
Address | Address 
FUNCTION FORMAT Mode Mode 







CONTROL TRANSFER (Continued): 


Protected Mode Only (Indirect Intersegment): 
Via call gate to same privilege level 

Via TSS 

Via task gate 


RET = Return from CALL: 


178 +m" 
183 +m 





Within segment 11000011 







+m 


11000010 11+m 


11001010 data-high 


Within seg adding immed to SP 


Intersegment 15+m 





Intersegment adding immediate to SP 
Protected Mode Only (RET): 


15+m 






80286 INSTRUCTION SET SUMMARY (Continued) 
















Real Virtual 
Address | Address 
Mode Mode 





















To different privilege level 55+m 
JE/JZ = Jump on equal zero o1tt10100[ disp | 7+mor3] 7+mor3 
JL/JNGE = Jump on less not greater or 01111100 7+mor3|7+mor3 

equal 
greater 
JB/JNAE = Jump on below not above or 01110010 | a | 7+mor3|7+mor3 
equal 
BE aaa asc aa 
above 
JP/JPE = Jump on parity/parity even 01111010 | disp T+mor3]7+mor3 
JO = Jump on overflow o11t10000] dsp | 7+mor3|7+mor3 
JS = Jump on sign o1111000[ disp | 7+mor3|7+mor3 
JNE/JNZ = Jump on not equal not zero 01110101 | disp 7+mor3 | 7+mor3 
JNL/JGE = Jump on not less greater or 01111101 | ae | 7+mor3|}7+mor3 
equal 
JNLE/JG = Jump on not less or equal o1taddd4 | ase | 7+mor3}7+mor3 
greater 
JNB/JAE = Jump on not below above or 01110011 | ase | 7+mor3}7+mor3- 
equal 
JNBE/JA = Jump on not below or equal o1110141 | ae 7+mor3}7+mor3 
above 
JNP/JPO = Jump on not par / par odd 7+mor3 |] 7+mor3 
JNO = Jump on not overflow 01110001 | disp 7+mor3|7+mor3 
JNS = Jump on not sign 01111001 | disp 7+mor3|7+mor3 
LOOP = Loop CX times 11100010 | disp 8+mor4 | 8+mor4 










LOOPZ/LOOPE = Loop while zero equal 11100001 8+mor4 | 8+mor4 


LOOPNZ/LOOPNE = Loop while not zero 
equal 





8+m or 4 | 8+m or 4 





JCXZ = Jump on CX zero 8+mor4 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 
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Protected 












8,9,11,12 
8,9,11,12 
8,9,11,12 





8,9 


8,9 










8,9,11,12 


8,9,11,12 























80286 INSTRUCTION SET SUMMARY (Continued) 


CLOCK COUNT COMMENTS 


Protected Protected 
Real Virtual Real Virtual 
Address | Address | Address | Address 
FUNCTION FORMAT Mode Mode Mode Mode 


\ CONTROL TRANSFER (Continued): 





INT = Interrupt: 


Type 3 11001100 23+m 


Type specified 


INTO = Interrupt on overflow 11001110 24-mor3 | 24- or 3 


(3 if no) (3 if no) 
(Interrupt) | (Interrupt) 


Protected Mode Only: 
Via interrupt or trap gate to same privilege level 40+m 811,12 
Via interrupt or trap gate to fit different privilege level 78+m 811,12 
Via Task Gate 167+m 8,11,12 


IRET = Interrupt return 11001111 31+m 8,9,11,12,15 


Protected Mode Only: 
To different privilege level 
To different task (NT = 1) 


55+m 8,9,11,12,15 
169 +m 8,9,11,12 


mod reg r/m a 13° 6,8,9,11,12 


(Use INT 
clock 
count if 
exception 
5) 


BOUND Detect value out of range 01100010 


‘a PROCESSOR CONTROL 
Non CLC = Clear carry 

CMC = Complement carry 11110101 
STC = Set carry 11111001 
CLD = Clear direction 11111100 
STD = Set direction 41111101 
CLI = Clear interrupt 11111010 
STI = Set interrupt 11111011 
HLT = Halt 11110100 
WAIT = Wait 10011011 
\ LOCK = Bus lock prefix 11110000 


sk switched flag 00001111 


‘Namath 


00000110 


ESC = Processor Extension Escape 10011TTT mod LLL r/m 


= 
5 
= 
2 
oO 
ce} 
8 
3 
ce} 
a 
oO 
3 
2 
°o 
° 
oO 
8 
g 
Q 
OQ 
Es 
oO 
g 
FH 
co} 
3 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 
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80286 INSTRUCTION SET SUMMARY (Continued) 


Protected Protected 
Real Virtual Virtual 
Address | Address | Address | Address 


FUNCTION FORMAT Mode Mode 


PROTECTION ‘CONTROL ee oes es 

‘LepT oad global desert table onder : . : 
SGDT~ Sto ga desi te et a 

: LIDT = Load interrupt descriptor table register. ae . 
-SIDT = Sie Inleqent deserintor table register: 


“oT Load local descriptor table reasstet : : : 
_ fom register meron 


a ‘SLOT Store local descriptor table register ie a 
ze register/memory coe 


LTR * Load task register tom register/memory 


“mod 1.0.1 r/m 


VERR = Verity wile acc 


Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 


Footnotes 


The effective Address (EA) of the memory operand is REG is assigned according to the following table: 
computed according to the mod and r/m fields: 


if mod = 11 then r/m is treated as a REG field oe? ee a 
if mod = 00 then DISP = 0%, disp-low and disp-high are 000 000 
absent 001 001 
if mod = 01 then DISP = disp-low sign-extended to 16-bits, 010 010 
leptin is absent e par a 011 011 
if mod = 10 then DISP = disp-high: disp-low 100 400 


if r/m=000 then EA = 
if r/m=001 then EA= 
if r/m=010 then EA= 
if r/m=011 then EA= 
if r/m=100 then EA= 
if r/m=101 then EA= 
if r/m=110 then EA= 
if r/m=111 then EA= 


(BX) + (SI) + DISP 
(BX) + (Dl) + DISP 
(BP) + (SI) + DISP 
(BP) + (Dl) + DISP 
(Sl) + DISP 

(Dl) + DISP 

(BP) + DISP* 

(BX) + DISP 


101 
110 
111 


101 
110 
111 


The physical addresses of all operands addressed by the 
BP register are computed using the SS segment register. 
The physical addresses of the destination operands of the 


DISP follows 2nd byte of instruction (before data if 
required) 
*except if mod = 00 and r/m=110 then EA = disp-high: disp-low. 


SEGMENT OVERRIDE PREFIX 


001 reg 110 


REG is assigned according to the following: 


string primitive operations (those addressed by the DI 
register) are computed using the ES segment, which may 
not be overridden. 


Segment 
REG Register 


00 ES 
01 cs 
10 ss 
11 DS 
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ABSOLUTE MAXIMUM RATINGS OPERATING RANGES 


Storage Temperature -65 to + 150°C Temperature 
Voltage on Any Pin with Part Number Range Vec 
Respect to Ground -1.0 to +7.0 V 
Power Dissipation ................665 ‘ ....3.3 Watts 80286-6 
80286-8 Ta =0 to 55°C 5.0 V +5% 
Stresses above those listed under ABSOLUTE MAXIMUM : TCASE = 0 to 85°C 


RATINGS may cause permanent device failure. Functionality 

at or above these limits is not implied. Exposure to absolute 

maximum ratings for extended periods may affect device Operating ranges define those limits over which the function- 
reliability. ality of the device is guaranteed. 


DC CHARACTERISTICS (Ta =0 to 55°C, Tcase =0 to 85°C; Voc =5 V £5%) 


Pv | mur tow votage | 

[Win | input HIGH Voltage TC 

[Yue | GLK input tow votage | 

[Vine | GLK Input HIGH Vote ——s| ; 

F Vor | Output Low votge ——sift=20ma ST | OT 
0 V<vin <Voo 

Supply Current (turn on, 0°C) 


Input Sustaining Current on ra 
BUSY and ERROR pins Vin = 0 V = 


Notes: 1. Low temperature is worst case. 





=) 


Hi m}oatn He 
=a|Sl/o 
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SWITCHING CHARACTERISTICS (T, =0 to 55°C, Tcase =0 to 85°C) 


AC timings are referenced to 0.8 V and 2.0 V points of signals as illustrated in datasheet waveforms, unless otherwise 
noted. 


Description 


System Clock (CLK) Period 


System Clock (CLK) LOW Time 


nN 
oO 
o 


Sat at 
NIN] O 


a 


ny 
Ni 


. Asynchronous inputs are INTR, NMI, HOLD PEREQ, ERROR, and BUSY. This specification is given only for testing purposes to 
assure recognition at a specific CLK edge. 

. Delay from 0.8 V on the CLK to 0.8 V or 2.0 V or float on the output as appropriate for valid or floating condition. 

. Output load: C_ = 100 pF. 

. Float condition occurs when output current is less than ILO in magnitude. 

. Delay measured from address either reaching 0.8 V or 2.0 V (valid) to status going active reaching 2.0 V or status going inactive 
reaching 0.8 V. 

. For load capacitance of 10 pF on STATUS/PEACK lines, subtract typically 7 ns for 8 MHz spec, and maximum 7 ns for 10 MHz. 


82284 Timing Requirements 


82284-6 82284-8 82284-10 


Description 


SRDY/SRDYEN Set-up Time 


12 SRDY/SRDYEN Hold Time 
ARDY/ARDYEN Set-up Time 
14 ARDY/ARDYEN Hold Time 





PCLK Delay 


Note 1. These times are given for testing purposes to assure a predetermined action. 
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82C288 Timing Requirements 


Parameters Description ——ees Conditions 


CMDLY Set-up Time 
CMDLT Hold Time 


Command Delay [Command Inactive ene a0 oe Ta 
from CLK Command Active ee 5 mA Max. 


ALE Active Delay 
ALE Inactive Delay 
DT/R Read Active Delay 


DT/R Read Inactive Delay C_ = 150 pF 
lo. = 16 mA Max. 


DEN Read Active Delay loH =-1 MA Max. 
DEN Read Inactive Delay 

DEN Write Active Delay 

DEN Write Inactive Delay 


nO 
o 
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82C288-6 82C288-8 


82C288-10 








SWITCHING WAVEFORMS 
MAJOR CYCLE TIMING 


BUS CYCLE TYPE \ af 
Vow | —+1@ os 


al | 
et Tg HPT 


® ligt 
0, coon MM, 1), on ‘ VAUD IF Ts 


—| @ 


eco TMK omnes TTP 


05-0) -- - - ~~ --—~--_-~—~- ---- 





{ 


remy \\\\\\ 
NN 


SROV. SROVER \\\\\\ 





(13) 





A114 


ANNU ITAA. LLLLLALILLLLLLLL 


NN 
AI 


(s) 





~~ a 
§ | sro. mroven sag a ee paling Sing ai 
4 


PCLK 
Lu 
- 


ALE 


ow TIO 





®, 





@ 


—— 


@ @ = 
MMMM) OBS Y//s 


| 


Sets» 





2-62 





LMI ILL 





WF007982 


Note: 1. MWTC is valid at this point only if CMDLY is LOW. 
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SWITCHING WAVEFORMS (Continued) 


80286 ASYNCHRONOUS INPUT 80286 RESET INPUT TIMING AND 
SIGNAL TIMING SUBSEQUENT PROCESSOR CYCLE PHASE 


BUS CYCLE TYPE 


PCLK 
(SEE NOTE 1.) 


INTR,NME 
HOLD,PEREQ 
(SEE NOTE 2.) 


WF009930 


1. PCLK indicates which processor cycle WF007930 
phase will occur on the next CLK. PCLK 
may not indicate the correct phase until Note 1: When RESET meets the set-up time 
the first bus cycle is performed. shown, the next CLK will start or re- 
. These inputs are asynchronous. The set- peat $1 of a processor cycle. 
up and hold times shown assure recogni- 
tion for testing purposes. 


EXITING AND ENTERING HOLD 


WF009942 


These signals may not be driven by the 80286 during the time shown. The worst case in terms of latest float 
time is shown. 

. The data bus will be driven as shown if the last cycle before T, in the diagram was a write Tc. 

. The 80286 floats its status pins during Ty. External 20 kQ resistors keep these signals high (see Table 15). 

. For HOLD request set-up to HLDA, refer to Figure 34. 

. BHE and LOCK are driven at this time but will not become valid until Ts. 

. The data bus will remain in three-state OFF if a read cycle is performed. 
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SWITCHING WAVEFORMS (Continued) 
80286 PEREQ/PEACK TIMING REQUIRED PEREQ TIMING FOR ONE TRANSFER. ONLY 


BUS CYCLE TYPE 










af) 






Vow, 










VO READ i PROC. EXT. TO MEMORY MEMORY WRITE f PROC. EXT. TO MEMORY 
MEMORY READ iF MEMORY TO PROC. EXT. ra VO WRITE IF MEMORY TO PROC. EXT. 





MEMORY ADDRESS IF PROC. EXT. TO MEMORY TRANSFER 
VO PORT ADORESS OOFA(H) IF MEMORY TO PROC. EXT. TRANSFER 







VO PORT ADDRESS OOFA(H) IF PROC. EXT. TO MEMORY TRANSFER 
MEMORY ADDRESS IF MEMORY TO PROC. EXT. TRANSFER 


(is) 
BE meen 
(SEE NOTE 2.) ae 
ree TIM AL LLLLLLLLLLLLLLL LLL LLL LLL LLL LLL LLL 


WF007953 











ASSUMING WORD-ALIGNED MEMORY OPERAND; IF ODD ALIGNED, 80286 TRANSFERS TO/FROM 
MEMORY BYTE-AT-A-TIME WITH TWO MEMORY CYCLES. 


Notes: 1. PEACK always goes active during the first bus operation of a processor extension data operand transfer se- 
quence. The first bus operation will be either a memory read at operand address or I/O read at port address 
OOFA(H). 


2. To prevent a second processor extension data operand transfer, the worst case maximum time (shown above) 

is: 3x @-@max-@min. The actual, configuration dependent, maximum time is: 3x @-(@Qmax-@min t AxX2x@. 
A is the number of extra T, states added to either the first or second bus operation of the processor extension 
data operand transfer sequence. 


INITIAL 80286 PIN STATE DURING RESET 












BUS CYCLE TYPE 





ee ee Sap 
Ly es 
81-80 ee 
ne = — Fj ==. 
aes oo i ae 
Cd | | (13) 
Beis canon oe ee 
Locx UNKNOWN ~ y —— 
® (SEE NOTE 3.) 
ESTMBY))))Y999)9999999999999999999999))9999))99999999))999)99))9)))))))) See ae 
©) IF HOLD IS NOT ACTIVE (SEE NOTE 4) 
HLDA UNKNOWN K : 





WF007962 






Notes: 1. Set-up time for RESET t may be violated with the consideration that $1 of the processor clock may begin one 
system CLK period later. 


2. Set-up and hold times for RESET | must be met for proper operation, but RESET 1 may occur during $1 or ¢2. 
3. The data bus is only guaranteed to be in three-state OFF at the time shown. 


4. HOLD is acknowledged during RESET, causing HLDA to go active and the appropriate pins to float. If HOLD 
remains active while RESET goes inactive, the 80286 remains in HOLD state and will not perform any bus 
accesses until HOLD is deactivated. 








50 














ow 
o 
c 
ao 
Io 
oe) 
o 





n 
z 
2 
7) 
z 
uJ 
= 
a 
al 
< 
o 
2) 
> 
x= 
a 








The International Standard of 
Quality guarantees a 005% AQL on all 
electrical parameters, AC a DC, 
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